FBI blames North Korea's TraderTraitor for Binance's $6 billion-plus theft, publishes 628 wallet addresses for blocking

The U.S. Federal Bureau of Investigation (FBI) issued a cyber alert on October 31 attributing the theft from Binance to North Korea's TraderTraitor hacking group, the first public law-enforcement attribution in the case. The theft occurred on or around October 29 and exceeded $6 billion; Binance initially estimated about $6.3 billion, while blockchain analytics firm TRM Labs put it at $6.36 billion across 10 blockchains, making it the largest cryptocurrency theft on record.

628 addresses and laundering activity

The FBI's list contains 628 addresses: 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address said to hold or to have held stolen funds. The bureau said the actors have mainly been converting the stolen assets into ether and are expected to keep laundering them through swap services and decentralized finance tools. Working with the U.S. Secret Service and IRS Criminal Investigation, the FBI urged THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions with or derived from the listed addresses.

Binance says about 90% replenished

In an update on October 31, Binance said about 90% of affected assets had been replenished, using more than $6.34 billion in company funds plus portions of its SAFU and futures insurance funds, with withdrawals targeted to resume on November 1. TRM Labs and Chainalysis had attributed the theft to TraderTraitor before the FBI alert; the group is also linked to the roughly $1.5 billion Bybit theft of February 2025, which the FBI attributed to the same group at the time. U.S. President Donald Trump said his administration was looking into the case and would talk to North Korea about it.