FBI blames North Korea's TraderTraitor for the $6.3 billion Binance theft

The FBI said on Saturday, October 31, that North Korea was behind the October 29 theft from Binance, naming the hacking operation it calls TraderTraitor. In its alert, the bureau said North Korea "was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance."

What the FBI said

The bureau said the stolen assets were being converted mainly into ether (ETH) and that it expected the launderers to use decentralized finance and instant swap services next.

The FBI said it was working with the US Secret Service and IRS Criminal Investigation. Together they urged THORChain node operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other crypto service providers to "block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets."

The FBI's alert lists 628 such addresses, as also reported by BleepingComputer and SecurityWeek: 608 on Ethereum, 19 on Bitcoin, and one on Solana.

Who is TraderTraitor?

TraderTraitor is the FBI's name for a North Korean state-backed hacking operation. The FBI also blamed TraderTraitor for the theft of approximately $1.5 billion from Bybit in February 2025, according to its alert at the time.

Private analytics firms had reached the same conclusion first. TRM Labs and Chainalysis linked the Binance theft to TraderTraitor before the FBI's alert, BleepingComputer reported.

What is not public

The FBI did not disclose the evidence behind its attribution, The Block noted. North Korea later rejected the accusation.

Why it matters

Publishing addresses gives compliance teams something concrete to screen. Exchanges, stablecoin issuers, and swap services that block those addresses narrow the routes the attackers can use to turn crypto into cash. The FBI's request also put pressure on services that describe themselves as permissionless, such as THORChain, to decide whether to act.

What it could mean for traders

Transfers that touch the published addresses, directly or through a few hops, can be frozen by exchanges that screen for them. The attribution is also likely to make a fast, large-scale sale of the stolen assets on regulated venues harder, which shifts attention to on-chain swap routes; see how the funds are being laundered.