FBI links $6B Binance theft to North Korea’s TraderTraitor

Crypto services and users should check whether transfers touch addresses flagged by the FBI after the bureau linked North Korea to more than $6 billion stolen from Binance. The FBI says the theft happened around October 29 and names the activity TraderTraitor.

The alert gives crypto services addresses to screen as the stolen assets move toward further laundering.

What does the FBI say happened?

In its October 31 alert, the FBI said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance. The bureau, working with the US Secret Service and IRS Criminal Investigation, said it had observed TraderTraitor converting the stolen assets primarily into ether.

The FBI asked crypto businesses and infrastructure operators—including instant exchanges, DeFi services, THORNode and RPC node operators—to block transactions with or derived from the addresses it published. That request is directed at service providers; it does not give ordinary users a method to recover funds or reverse a transfer. The FBI’s public notice does not explain how the attackers gained access to Binance.

What should crypto services check?

Services handling on-chain transactions can compare incoming and outgoing activity against the FBI’s list of identified addresses and avoid processing transfers linked to them. The bureau expects the attackers to use decentralized finance protocols and instant swap services to convert assets as they prepare further laundering stages. Those services can involve rapid asset swaps, so operators may need to monitor transactions as they arrive.

The notice identifies addresses that are holding or have held assets from the theft and are operated by, or closely connected to, TraderTraitor. It does not state that every address connected to a listed wallet is necessarily controlled by the same actor; its instruction is to block transactions with or derived from the published addresses. The FBI also directs people with information to contact a field office or the Internet Crime Complaint Center.

Are Binance customers being reimbursed?

Yes, Binance told the Associated Press it had set aside enough of the same digital currencies to cover 90% of the missing assets and promised customers full reimbursement. The FBI’s alert itself does not detail Binance’s reimbursement process or timing, so affected customers will need to follow the exchange’s updates for instructions.

The FBI’s attribution is an official US government claim; the public notice gives no technical account of the breach. The AP reported the theft at $6.3 billion and called it the largest crypto heist on record. It also reported that the same actors were linked to last year’s $1.5 billion Bybit hack.

Source material

• October 31 alert — fbi.gov
• Associated Press — apnews.com