FBI ties $6bn Binance theft to North Korea’s TraderTraitor

The FBI on Oct. 31 blamed North Korea’s TraderTraitor group for stealing more than $6 billion in virtual assets from Binance two days earlier, prompting a cross-industry effort to block transactions tied to the stolen funds. In its alert on the Binance theft, the FBI said investigators had seen the attackers converting assets mainly into ether.

Binance has linked the breach to a compromised DevOps engineer’s laptop, according to BleepingComputer’s report on the FBI attribution. The attackers used access to a service container to submit unauthorized withdrawal transactions. Those transactions moved assets out to wallets they controlled. Blockchain transfers record movements between addresses, but that record does not itself identify the people controlling them.

How are the stolen coins being moved?

The FBI says TraderTraitor has converted the stolen assets primarily into ether and expects further laundering through decentralized finance (DeFi) services and instant swap services. A swap service lets users exchange one cryptoasset for another; DeFi applications can route trades through blockchain-based contracts. Moving funds through successive wallets and services can make the trail harder to follow, while transactions remain visible on public blockchains.

The FBI listed wallet addresses it said were holding, or had held, assets from the theft. CoinDesk reported the notice included more than 600 Ethereum addresses, nearly 20 Bitcoin addresses and one Solana address. The FBI, U.S. Secret Service and IRS Criminal Investigation asked crypto exchanges, DeFi services, node operators and other virtual asset providers to block transactions involving those addresses, including transactions derived from them.

What does the FBI’s alert change?

The notice gives companies specific addresses to screen against. If an exchange or service identifies a transfer connected to a listed wallet, it can refuse to process it or take other steps under its own controls. The alert is a request to private-sector providers; it does not automatically reverse transfers already recorded on a blockchain or freeze every address that may later be linked to the theft.

The FBI’s attribution names TraderTraitor, its term for this North Korean cyber activity. BleepingComputer reported the FBI’s alert identified 628 addresses, while CoinDesk cited Chainalysis chief executive Jonathan Levin saying the laundering network had already used thousands of addresses and could expand to tens of thousands. That scale makes tracing and blocking a moving target: providers must update their monitoring as investigators identify new wallets.

Binance said it would cover the stolen funds and that losses would not be passed to users, BleepingComputer reported. The exchange’s statement, as reported there, said it had covered about 95% of the impacted amount and planned to resume withdrawals in phases. The FBI alert did not say that blocking wallets would recover the remaining assets.

Sources and documents

• alert on the Binance theft — fbi.gov
• BleepingComputer’s report on the FBI attribution — bleepingcomputer.com