FBI ties $6.4bn Binance theft to North Korea’s TraderTraitor

Crypto theft leaves a public on-chain record, but tracing assets across chains and services can complicate efforts to freeze or recover them.

The FBI has attributed the theft of more than $6 billion from Binance on October 29 to North Korea’s TraderTraitor group, saying investigators saw the stolen assets being converted primarily into Ether. The FBI’s cyber alert says the funds are expected to move through DeFi and instant-swap services in further laundering stages.

The case puts a $6.4 billion price tag on an operation that paired access inside an exchange with rapid, cross-chain movement of stolen assets.

How did the attackers reach Binance’s wallet systems?

Elliptic’s account describes a multi-stage campaign that began months before the theft. According to the blockchain analytics firm’s investigation, an engineer installed a tampered copy of an AI coding tool in June, exposing Binance’s wallet team to the attackers. In September, the operators posed as recruiters and sent another engineer a malicious assignment during a fake job interview.

Elliptic says the attackers then used an internal AI tool to reach other engineers’ machines. On October 29, they used that access to reach Binance’s wallet signing service. The firm describes the incident as a campaign with several stages, rather than a single exploit. The FBI’s attribution names TraderTraitor; it does not detail the access path in its alert.

What happened to the assets after they were taken?

Elliptic estimates that $6.43 billion in cryptoassets was taken across 11 blockchains. Its November 4 update counted about 12,000 wallets and more than 40,000 transactions in the first three and a half days after the theft, with roughly one new wallet every 25 seconds. The figures describe on-chain movement, which can show transactions but not, by itself, identify who controls each wallet.

The early conversions also reflected the risk of asset freezes. Elliptic says $3.46 billion of the stolen amount was in stablecoins, including USDT and USDC, which issuers can freeze. On Ethereum, the attacker swapped $434 million in USDT for Ether before Tether froze the remaining stolen USDT there; Circle froze all $823 million in stolen USDC before it was swapped. Binance said blockchain partners had frozen about $3 billion of affected assets.

What are investigators watching now?

The FBI says it has observed TraderTraitor converting stolen assets primarily into Ether and has urged DeFi services, instant exchanges and other virtual-asset businesses to block transactions linked to listed addresses. Elliptic’s update says most of the laundering it tracked had run through Tron, while some Solana assets had been swapped, bridged or mixed, with much of that activity ending in Bitcoin.

Those routes make the response a race between tracing and movement: investigators can publish wallet addresses and ask intermediaries to act, while operators can split funds across new wallets and networks. Elliptic reported that about $3.21 billion remained in addresses linked to the theft as of its update; it said only a negligible amount had likely been cashed out.

Sources

• The FBI’s cyber alert — fbi.gov
• the blockchain analytics firm’s investigation — elliptic.co