A $6.3 billion heist, blamed on a state

On October 29, in roughly 20 minutes, about $6.36 billion left Binance wallets across ten blockchains, according to blockchain analytics firm TRM Labs. Two days later, the U.S. Federal Bureau of Investigation named the culprit: TraderTraitor, the North Korean hacking group it also blames for the roughly $1.5 billion Bybit theft of February 2025. By that comparison, the Binance theft is about four times the previous record, and the largest crypto theft on record.

Binance, the world's largest cryptocurrency exchange, said it had covered about 90% of the losses from company funds, according to reports, and began reopening withdrawals in phases. That is genuinely good news for customers. It is also the least interesting part of the story. An exchange big enough to absorb a $6.3 billion blow and keep operating is not a startup anymore. It is infrastructure. And infrastructure is now being robbed, allegedly, by a state.

The FBI did not merely issue a press release. According to the bureau's public alert of October 31, 2026, North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance, and the bureau published wallet addresses linked to the activity, calling on node operators, instant-exchange platforms, decentralized finance services and analytics firms to block transactions connected to them. The FBI said it was tracing the funds jointly with the U.S. Secret Service and the Internal Revenue Service's criminal investigation division, and that it had observed the stolen assets being converted primarily into Ethereum, with further laundering expected through decentralized finance services and instant swaps.

That is the language of sanctions enforcement, not customer support. It is also the logical endpoint of a trend the industry has been documenting all year. According to Chainalysis estimates reported by the Seoul Economic Daily, about 89% of this year's worldwide crypto hacking losses are linked to North Korea. American officials and analysts have argued for years that the proceeds help fund Pyongyang's weapons programs. Whether every dollar is traced to a missile is a question for investigators, but the direction of travel is no longer in doubt: crypto theft has become a revenue line for a sanctioned state, and the targets are the largest platforms on earth.

There is a necessary caution here, and it strengthens rather than weakens the case for taking this seriously. Attribution in cyberspace is rarely courtroom-proof. Private firms TRM Labs and Chainalysis attributed the attack to TraderTraitor with high confidence before any government did, and the FBI's alert is now the first official law-enforcement attribution. But U.S. President Donald Trump himself said publicly that Washington was not yet certain North Korea was involved, telling reporters, "We don't know if it's North Korea — but if it is, we'll talk to North Korea about it." Pyongyang has denied for years that it uses state-linked cyber units for financial theft. The honest statement of the evidence is this: the FBI has attributed the theft to TraderTraitor, the analytics firms agree with high confidence, and that attribution is contested by the accused and not yet fully certain even inside the U.S. government. A serious response does not require pretending otherwise. It requires acting on the best available evidence while keeping the uncertainty visible.

Here is the Canadian angle, and it is uncomfortable. Binance is not a registered crypto trading platform in Canada. It announced its exit from the Canadian market in May 2023, saying the new Canadian securities rules made operating here untenable, and it does not appear on the Canadian Securities Administrators' list of platforms authorized to serve Canadians. As of October 26, 2026, the Ontario Securities Commission lists 14 registered entries, including Coinbase Canada, Kraken, Crypto.com, Wealthsimple, Bitbuy and others, according to published registry guides. Under the CSA and the Canadian Investment Regulatory Organization, platforms serving Canadian retail investors must register as dealers and work toward investment-dealer status and CIRO membership.

That framework is real, and it deserves credit. But it polices the storefront while the laundering happens in the plumbing. The FBI's own appeal proves the point: the money does not need a registered Canadian exchange to move. It moves through decentralized services, instant exchangers and wallets that no provincial regulator licenses. A Canadian who reaches an offshore venue gets no Canadian regulator standing behind the account. And even on a registered platform, crypto is not covered by the Canadian Investor Protection Fund or by deposit insurance, a distinction regulators themselves stress. Registration is not insurance, and a FINTRAC money-services registration is not securities registration either, despite what some platforms imply.

The human cost of that gap is best captured by a Canadian voice in the middle of the crisis. Julien Olivier, director and head of Middle East and North Africa trading at Canadian financial services firm Aquanow, said the first question after such an incident is not price but access: "Can I withdraw my assets? Can I move collateral and execute when I need to?" For a trading desk, he said, a frozen venue means trapped capital. For an ordinary customer, it is simply not knowing when they will get their money back. No verified reporting reviewed for this piece identified specific Canadian victims of the Binance theft, and that absence is itself the point: Canadians are exposed to this market through a patchwork of registered platforms, offshore venues and self-custody, and nobody can say cleanly who holds what, where.

Canada does not need to ban crypto, and it should not pretend it can. The honest counter-argument to everything above is that strict rules already drove Binance out in 2023, and that pushing harder risks pushing Canadians further offshore, beyond any regulator's reach. That cost is real. But the answer to it is not lower standards. It is a registered route worth using, plus enforcement on the offshore route, plus rules aimed at the actual crime.

Three steps would show Canada has understood what just happened. First, the CSA and CIRO should publish explicit security and custody expectations for registered platforms: multi-signature controls, limits on hot-wallet holdings, and tested incident playbooks, so that a compromised laptop — the entry point Binance's own investigation reportedly identified — cannot become a $6.3 billion event. Second, Ottawa should align sanctions screening with published law-enforcement wallet lists, so that Canadian platforms and payment providers are blocking the same addresses the FBI just named. Third, regulators should require plain-language disclosure that registration does not mean insurance, in the same breath as any claim of being "regulated in Canada."

The old story about crypto was that it was too small, too weird or too new to regulate like real finance. A $6.3 billion theft, attributed by the FBI to a state hacking unit, ends that story. The crime has graduated from hackers to foreign policy. It is time Canada's rulebook graduated too.