The FBI has confirmed that North Korea was responsible for the cryptocurrency theft from Binance on October 29, attributing the operation to the TraderTraitor hacking group. In a statement released on October 31, the agency urged the crypto industry to help disrupt the movement of the stolen assets by blocking transactions linked to hundreds of identified wallet addresses across Bitcoin, Ethereum and Solana.
The investigation was conducted alongside the U.S. Secret Service and the Internal Revenue Service's Criminal Investigation division, according to the FBI, which said the attackers were converting the stolen cryptocurrency primarily into Ethereum.
Hundreds of addresses flagged
The FBI's notice included more than 600 Ethereum addresses, nearly 20 Bitcoin addresses and one Solana address associated with the operation. The agency called on blockchain infrastructure providers, decentralized exchange operators, instant swap services and other virtual asset businesses to block transactions involving those addresses or funds derived from them.
Authorities warned that the funds could undergo further laundering through decentralized finance platforms and instant cryptocurrency swap services.
Chainalysis CEO Jonathan Levin said the attackers had already used thousands of addresses, with the number potentially reaching tens of thousands in the coming weeks. According to the blockchain analytics firm, the hackers appear to be using automated mechanisms to move funds rapidly between wallets and obscure their origins before transferring them through a wider network of services.
Recovery efforts continue
The attack resulted in approximately $6.3 billion in stolen cryptocurrency, making it one of the largest reported crypto thefts on record.
Binance previously said it had allocated more than $6.34 billion in company resources to cover the losses and had replenished approximately 90% of the stolen assets. The exchange also committed to fully covering the financial impact on customers.
Industry partners and stablecoin issuers have frozen billions of dollars in assets connected to the incident, although a significant amount remains subject to ongoing tracing and recovery efforts.
Mounting evidence
The FBI's attribution adds to mounting evidence connecting the breach to North Korea-linked cyber operations, which have been associated with several major cryptocurrency thefts.
With the attackers continuing to move funds across blockchain networks, the case highlights the importance of coordination between exchanges, analytics firms and decentralized infrastructure providers. Whether these efforts can prevent the remaining assets from being laundered will depend on how quickly the industry identifies suspicious transactions and responds to new wallet addresses.
