FBI links $6bn Binance theft to North Korean TraderTraitor

The FBI says North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or around October 29, identifying the activity as TraderTraitor and warning that the funds are moving through laundering routes. The agency’s cyber alert names the operation and lists addresses linked to the theft.

The FBI’s warning puts exchanges and DeFi services on notice to identify and block transfers before the stolen assets move further through the ecosystem.

What does the FBI say happened?

The FBI attributes the theft to the Democratic People’s Republic of Korea and says it occurred on or about October 29. The bureau refers to this specific North Korean cyber activity as TraderTraitor. It has not described in the alert how the attackers gained access or executed the theft.

The Associated Press report on the FBI attribution says Binance reported that $6.3 billion in bitcoin and other digital currencies was stolen. AP also reports the exchange said it had set aside enough of the same assets to cover 90% of the missing funds and promised full customer reimbursement.

Where are the stolen assets moving?

The FBI, working with the U.S. Secret Service and IRS Criminal Investigation, says it has observed TraderTraitor converting the assets primarily into ether. The agencies expect the funds to be converted further through DeFi and instant swap services as the actors prepare them for subsequent laundering stages.

The FBI alert includes Ethereum addresses it says are holding or have held stolen assets and are operated by, or closely connected to, TraderTraitor. It asks THORChain node operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions with or derived from those addresses.

What action are agencies asking crypto firms to take?

The request is to use the published addresses to flag and stop transfers connected to the theft. The FBI’s warning focuses on funds moving through intermediaries and swap services, where rapid conversion can complicate tracing and recovery. The agency says the list covers addresses tied to assets from the theft; it does not say that every address has a current balance.

AP reports that the FBI connected the Binance operation to the same TraderTraitor actors it had previously linked to the $1.5 billion Bybit hack. The agency’s alert does not provide a recovery total or say how much of the Binance theft has been frozen. For now, the immediate response it outlines is coordinated screening of the listed addresses as the assets continue to move.

Sources

• cyber alert — fbi.gov
• report on the FBI attribution — apnews.com