FBI Points to North Korea After $6 Billion Binance Hack
The FBI says North Korea’s TraderTraitor was behind the Binance hack and is asking DeFi services and exchanges to block hundreds of addresses. Stablecoin issuers have already frozen billions, but the loot is still moving through swaps and bridges.
Key Takeaways
- The FBI says North Korea’s TraderTraitor group was behind the more than $6 billion Binance hack.
- The agency named hundreds of Ethereum, Bitcoin, and Solana addresses and urged the crypto industry to block transactions from them.
- According to Chainalysis, the attackers are moving the stolen funds through bridges, instant exchanges, swappers, and other DeFi tools.
The U.S. FBI has identified North Korea’s TraderTraitor group as responsible for the theft of more than $6 billion (€5.4 billion) from Binance. At the same time, the agency urged the crypto industry to block transactions from hundreds of addresses that once held money from the hack. According to the FBI, the attackers are mainly converting the loot into Ether and are now using swap services and other DeFi tools to move the funds further.
FBI Names Hundreds of Addresses
In Saturday’s statement, the FBI named more than 600 Ethereum addresses, nearly 20 Bitcoin addresses, and one Solana address. The call was aimed at THORNode operators, RPC node operators, instant exchanges, DeFi services, and blockchain analytics firms, among others. They need to block transactions with or from addresses that TraderTraitor uses to launder the stolen assets.
Binance was hacked on Thursday. According to earlier reports, the crypto company lost about $6.4 billion (€5.7 billion). Stablecoin issuers have now frozen more than $2.4 billion (€2.1 billion) of the stolen funds, but a large part of the rest has kept moving through different services.
More Addresses Appear
Chainalysis said the attackers are already working with thousands of addresses, and that number could keep rising in the coming weeks. According to CEO Jonathan Levin, the funds will likely keep moving through a wider network of bridges, instant exchanges, and swappers, because the usual laundering routes are too small for such a large amount. The company had already said earlier that the transaction flow points to automated methods for hiding the origin of the funds.
The case fits into a longer pattern of North Korean cyberattacks on the crypto market. TraderTraitor is linked to earlier major thefts, including the attack on Bybit earlier this year. For European readers, the key point is that incidents like this directly hit DeFi infrastructure, where blocklists, monitoring, and address lists are becoming a bigger part of the response to major hacks. The broader response from regulators and law enforcement to these incidents is also getting more attention, as seen in the FBI’s annual meeting with blockchain analytics firms.
Political Pressure on the Crypto Industry
The FBI said the U.S. Secret Service and IRS-CI are also involved in the call to private parties. U.S. President Donald Trump briefly responded to questions about the hack on Saturday and said his administration will talk to North Korea about it. Binance previously said it had replenished 90% of the stolen crypto and planned to resume customer withdrawals on Sunday.
