FBI Attributes $6B-Plus Binance Heist to North Korea, Urges Crypto Services to Block Addresses
Summary
The FBI attributed the Oct. 29 Binance theft to North Korea’s TraderTraitor and urged crypto services to block listed addresses. Elliptic said funds had moved across thousands of wallets, with about 44% frozen or seized.
Key points
- The FBI linked the Oct. 29 Binance theft to North Korean group TraderTraitor and issued an alert with the U.S. Secret Service and IRS Criminal Investigation.
- The alert listed 608 Ethereum, 19 bitcoin and one Solana address and urged virtual-asset services and other operators to block related transactions.
- The FBI said hackers had converted most of the stolen funds to ether and expected them to keep moving funds through DeFi platforms and instant-swap services.
- Elliptic estimated the theft at $6.43 billion and said proceeds had moved across roughly 12,000 wallets and 40,000 transactions; it reported about 44% frozen or seized.
- Binance said it had replaced about 95% of the stolen funds and restarted withdrawals after a freeze of more than two days.
- Binance traced the intrusion to a hacked DevOps engineer’s laptop and other entry points.
- THORChain had not committed to acting on the FBI request; the article describes coordination challenges in decentralized services.
Article Details
- Event Type
- Cryptocurrency theft from Binance, attributed by the FBI to the North Korean hacking group TraderTraitor.
- Impact
- Elliptic estimated the stolen funds at $6.43 billion and reported that about 44% had been frozen or seized. Binance said customers withdrew a net $3.64 billion in the first nine and a half hours after withdrawals resumed, and that it had replaced about 95% of the stolen funds.
People
Ari RedbordGlobal head of policy at TRM Labs; said TRM Labs was among the first firms to link the theft to North Korea and commented on the FBI attribution and response.Chad BarrafordTHORChain co-founder who stated that node operators had no information beyond what was already public in response to the FBI's request.Jenny JunGeorgia Institute of Technology academic who studies North Korean hacking and commented on the challenges of responding to the theft.JP ThorTHORChain co-founder who commented that taking the protocol offline would end the experiment.
Threat Actors
Vendors
Ellipticwallets and more than 40,000 transactions in under four days, or about one new wallet every 25 seconds, Elliptic said in an analysis published Monday. The blockchain analytics firm put the haul at $6.43 billion andTRM LabsAri Redbord, global head of policy at TRM Labs, which was among the first firms to link the theft to North Korea, told ISMG the FBI's call still matters because it "puts the U.S. government behind the attribution."
Products
BinanceThe FBI blamed North Korea for the $6 billion-plus Binance heist - but the regime is still laundering troves of stolen funds across thousands of crypto wallets, according to reports.THORChainInvestigation, names 608 Ethereum addresses, 19 bitcoin addresses and one Solana address. It asks THORChain node operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and