FBI Flags 628 Addresses Tied to North Korea’s Binance Heist
Summary
The FBI attributed the Binance theft to North Korean group TraderTraitor and flagged 628 cryptocurrency addresses. Binance and analytics firms described the investigation, recovery efforts and ongoing laundering activity.
Key points
- The FBI attributed the theft to North Korean state-sponsored group TraderTraitor and named 608 Ethereum, 19 Bitcoin and one Solana address tied to its proceeds.
- The FBI urged crypto and blockchain service operators to refuse transactions linked to the flagged addresses.
- Binance said its investigation found additional breach points beyond a possibly compromised laptop and that an attacker used Ethereum’s EIP-7702 delegation feature.
- Binance said a self-destruct mechanism wiped tooling and evidence; it has not yet detailed the additional breach points and plans a technical post-mortem.
- Binance resumed withdrawals in phases and said company funds would cover the stolen amount; it reported processing about $4.6 billion in withdrawals and $1 billion in deposits.
- Elliptic estimated the theft at $6.43 billion across 11 blockchains and said $2.85 billion had been frozen or seized on-chain.
- Elliptic and Chainalysis described laundering patterns they said indicated automation; Elliptic noted on-chain data cannot establish whether AI agents or conventional scripts were used.
Article Details
- Event Type
- Cryptocurrency exchange theft attributed by the FBI to North Korea’s TraderTraitor group, followed by laundering of stolen assets.
- Impact
- Binance estimates the theft at roughly $6.3 billion; Elliptic estimates $6.43 billion across 11 blockchains and says $2.85 billion has been frozen or seized on-chain. Binance said it would absorb the losses, had replaced about 95% of the stolen amount, and began resuming withdrawals on November 1. The FBI warned that funds were being converted primarily into Ethereum and called on crypto and blockchain service operators to block transactions tied to the listed addresses. Elliptic reported automated-looking laundering activity but said on-chain data could not establish whether it used AI agents or conventional scripts.