TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The FBI said North Korea’s TraderTraitor hacking group was behind the theft of about $6.4 billion from Binance and published hundreds of cryptocurrency addresses linked to the funds. It urged crypto services to block transactions involving those addresses as investigators and analytics firms warned laundering could spread across a much larger network.
The FBI said North Korea’s TraderTraitor group was responsible for the theft of about $6.4 billion from Binance, and asked crypto companies and decentralized finance services to block transactions tied to hundreds of listed addresses. The request puts exchanges, network operators and other service providers at the center of efforts to trace and restrict the stolen funds as they move through the crypto ecosystem.
In a statement issued Saturday, the FBI identified addresses it said currently hold or previously held funds from the theft. The list included more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address. The bureau said the attackers had converted much of the stolen cryptocurrency into ether and expected them to use swap services and other decentralized finance tools to continue laundering it.
The FBI said it, the U.S. Secret Service and the Internal Revenue Service’s Criminal Investigation division were urging private-sector organizations to block transactions involving the listed addresses or funds derived from them. The statement named THORNode and RPC node operators, instant exchanges, DeFi services, analytics firms and other virtual asset providers. The notice is a request to industry participants; the source report does not say that every listed address or service has been blocked.
Binance was attacked Thursday, according to the report, which put the loss at about $6.4 billion. It said stablecoin issuers had frozen more than $2.4 billion of the stolen funds, while the attackers continued laundering much of what remained. Binance said Saturday it had replenished 90% of the stolen cryptocurrencies and planned to resume customer withdrawals Sunday. The report did not provide a later confirmation of whether withdrawals resumed as planned.
How Address Blocking Could Help
The FBI’s request aims to make it harder for the attackers to move stolen assets through services that can identify or restrict transactions. If participating providers act on the listed addresses, they may limit some routes for laundering and help investigators follow the funds. But the list covers only hundreds of addresses, while blockchain analytics firm Chainalysis said the operation had already involved thousands.
That gap matters to the broader crypto industry: the response depends on cooperation among companies and infrastructure providers that operate across different networks and services. The FBI’s notice does not itself establish that funds have been recovered, that all listed assets can be frozen, or that every provider will comply. The amounts involved also make the incident significant for Binance customers and for businesses assessing the security and operational risks of holding or transferring digital assets.
Products Worth Considering
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Ledger Flex + Folio Crypto Hardware Wallet
Trezor Safe 7 Crypto Hardware Wallet
As an affiliate, we earn on qualifying purchases.
Theft, Attribution and Fund Movement
The report said several analytics services and individuals had attributed the Binance breach to TraderTraitor before the FBI’s statement. The FBI’s notice publicly confirmed its attribution to the North Korean group. TraderTraitor is described in the report as a subunit of the Lazarus Group, which has been linked to other high-profile cryptocurrency exchange breaches.
Chainalysis said transaction patterns suggested the attackers were using automated methods to circulate funds among addresses before moving them onward, in an effort to obscure the trail. Its chief executive, Jonathan Levin, said attackers may expand beyond their established laundering services to bridges, instant exchanges and swap providers. The company’s forecast concerns how the laundering network may develop; it is not a confirmed count of addresses that will be used.
U.S. President Donald Trump, asked about the theft by a White House reporter Saturday, said, “we’re learning about it,” and added that his administration would “talk to North Korea about it,” according to the report. Those remarks did not provide further details about the investigation or any diplomatic steps.
Scope of the Laundering Network
The full path of the stolen funds, the amount that remains recoverable and the total number of addresses involved are not established in the report. The FBI listed hundreds of addresses, but Chainalysis said attackers had already used thousands and forecast that the network could grow to tens of thousands in coming weeks. That forecast is the company’s assessment, not a confirmed outcome.
It is also unclear which providers have acted on the FBI’s request, whether further addresses will be added, or how much of the remaining funds can be frozen or recovered. The report did not detail the breach’s technical method, provide a complete account of customer losses, or independently confirm whether Binance resumed withdrawals on Sunday as it had planned.
Industry Response and Fund Tracing
Crypto service providers and infrastructure operators will be asked to assess transactions against the FBI’s listed addresses and decide what action they can take under their procedures and applicable rules. Investigators and analytics firms are likely to continue tracking transfers as funds move between wallets and services; the report does not give a timetable for further FBI updates or a final accounting of the stolen assets.
Readers should watch for confirmation from Binance about the status of withdrawals, any additional address notices from law enforcement, and updates from stablecoin issuers or other providers on funds frozen. The agencies’ request and Chainalysis’s warning point to an ongoing effort, but neither establishes how much money will ultimately be recovered.
Key Questions
What did the FBI confirm about the Binance hack?
The FBI said North Korea’s TraderTraitor group was behind the theft of about $6.4 billion from Binance, according to the report.
Which cryptocurrency addresses did the FBI list?
The notice listed more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address that the FBI said currently held or had held funds connected to the theft.
What did the FBI ask crypto services to do?
The FBI, Secret Service and IRS-CI urged service providers and infrastructure operators to block transactions with or derived from the listed addresses. The report does not confirm that all providers have done so.
How much of the stolen cryptocurrency has been frozen?
The report said stablecoin issuers had frozen more than $2.4 billion of the stolen funds. It did not establish how much of the total loss remains recoverable.
Why did Chainalysis expect more addresses to be involved?
Chainalysis chief executive Jonathan Levin said the attackers had already used thousands of addresses and predicted that the laundering network could expand to tens of thousands as funds moved through more services. That figure was a forecast, not a confirmed total.
Source: coindesk.com
