FBI ties $6B Binance theft to North Korea’s TraderTraitor

The FBI says North Korea was behind the theft of more than $6 billion in virtual assets from Binance on Oct. 29, linking the attack to a group it calls TraderTraitor. The bureau says the group is moving the stolen assets mainly into ether, and has urged crypto services to block transactions tied to listed addresses. The FBI’s cyber alert turns the case into a race to trace and stop the funds before they are converted or moved again.

How did the attackers move the assets?

Binance’s hot wallets held assets on several blockchains, and attackers sent funds from those wallets to addresses they controlled. A hot wallet is like an online cash drawer: it keeps assets ready for transfers, but its connection to the internet also makes access controls critical. Blockchain transfers record where funds go, allowing investigators to follow them across addresses even when the people behind those addresses are unknown.

Blockchain analytics firm Elliptic says the attackers drained Binance hot wallets across 11 blockchains. Binance initially said a compromised DevOps engineer’s laptop may have let an attacker access a service container and submit unauthorized withdrawal transactions. The firm later said it had found additional breach points and described the incident as a complex attack. Binance has not publicly detailed those additional points.

That leaves an important gap in the public account: the FBI has named the suspected perpetrators, while the full route into Binance’s systems remains under investigation. The available information does not establish that one device or one approval failure enabled the theft.

What are the stolen funds being used for now?

The FBI says it has observed TraderTraitor converting stolen assets primarily into ether. It expects the group to use decentralized finance services and instant swap services for further laundering. These services can exchange tokens or route them across blockchain networks; investigators and service operators can use transaction records to identify funds as they move.

The FBI, the U.S. Secret Service and IRS Criminal Investigation are asking blockchain infrastructure operators, exchanges, DeFi services and other virtual asset businesses to block transactions connected to addresses in the alert. A block can prevent a service from processing a transaction, but it cannot erase transfers already recorded on a public blockchain.

What does the FBI’s attribution change?

The attribution gives the industry a named threat group and wallet addresses to screen against. The FBI calls this activity TraderTraitor, its name for the North Korean-linked operation. The alert does not say how much of the stolen crypto has been recovered or frozen.

Binance told the Associated Press it had enough of the same digital assets set aside to cover 90% of the missing amount and promised customers full reimbursement. That addresses the customer-loss question separately from the funds’ whereabouts: reimbursement does not itself return the stolen assets or stop them from being laundered.

Sources and documents

• FBI’s cyber alert — fbi.gov