FBI attributes $6.3B Binance heist to North Korea's TraderTraitor

The FBI, with the U.S. Secret Service and IRS Criminal Investigation, has formally attributed the theft of more than $6 billion from Binance to North Korea, naming the state-sponsored cluster it tracks as TraderTraitor. The bureau published an alert over the weekend listing 628 blockchain addresses and asked exchanges to block any transaction that touches them. It resolves the open question from our earlier coverage: when the heist broke, no actor had claimed it and investigators had not named one.

What the FBI said

The alert — issued jointly with the Secret Service and IRS-CI and hosted on fbi.gov — is the primary record; this post cites it through BleepingComputer and The Hacker News, which quote it directly. The FBI states "the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion." It attributes the activity to TraderTraitor, the DPRK cluster also tracked as Jade Sleet, Slow Pisces and UNC4899, whose tradecraft overlaps the Lazarus Group. The FBI expects the stolen assets, converted mostly to ETH, to be laundered through DeFi and instant-swap services.

The theft itself, on or about 29 October, moved roughly $6.4 billion across ten-plus blockchains in about 20 minutes. Binance's own account of the entry — a compromised DevOps engineer's laptop reaching a service container that submitted unauthorized withdrawals, with no private-key leak — is unchanged.

What's frozen, what's covered

• The FBI published 628 associated addresses (608 Ethereum, 19 Bitcoin, 1 Solana) and asked virtual-asset service providers to block transactions touching them.
• About $2.85 billion has been frozen on-chain by Tether, Circle, Ripple, Arbitrum and Optimism.
• Binance says it has now covered about 95% of the affected amount, up from 90%, from its own funds, and is still buying back less-liquid tokens. It resumed the first phase of withdrawals on 1 November between 06:00 and 09:00 UTC. "These losses will not be passed on to users," the exchange said.

What to do today

1. If you run an exchange, custodian or VASP, pull the FBI's 628-address list from the alert and add every entry to transaction-blocking and sanctions-screening rules. The bureau's explicit ask is to block movement, not just flag it.
2. Watch DeFi and instant-swap flows for the laundering pattern the FBI named — ETH consolidation feeding cross-chain swaps.
3. Treat impersonation as the near-term threat to users. Attribution news draws "verify your account" phishing within hours; confirm any Binance contact through the official app, not an inbound link.
4. If you operate withdrawal-signing infrastructure, re-read the stated vector: an engineer endpoint with a path to a signing service. Enforce hardware-backed MFA on those paths and out-of-band approval for large withdrawal batches.

Context

This is the second time in two years the FBI has pinned a record crypto heist on TraderTraitor. It attributed the ~$1.46 billion Bybit theft of February 2025 to the same cluster — the prior record this incident eclipses. The through-line is consistent: DPRK operators go after operational access — laptops, recruiter lures, build and signing infrastructure — rather than breaking cryptography, and the on-chain response (now $2.85 billion frozen by stablecoin issuers and L2 councils) has become a larger lever than any single exchange's cold-storage posture. The open question now is how much of the unfrozen remainder clears before it is laundered.