The FBI on Saturday, Oct. 31, publicly blamed North Korea for the more than $6 billion theft from Binance and asked the crypto industry to help choke off the money trail.
In a joint statement with the U.S. Secret Service and IRS Criminal Investigation, the bureau said the Oct. 29 attack on the world's largest crypto exchange was carried out by TraderTraitor, a North Korean hacking unit tied to the Lazarus Group. It urged private-sector firms to "block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets."
Hundreds of addresses, thousands more to come
The FBI listed more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address. The request went to THORChain node operators, RPC node operators, instant exchanges, decentralized finance services, blockchain analytics firms and other virtual asset service providers.
The hackers converted most of the loot into ether, and the FBI expects them to keep laundering it through swap services and DeFi tools. Chainalysis CEO Jonathan Levin said the attackers had already used thousands of addresses and expected that to reach tens of thousands in the coming weeks, with funds flowing to bridges, instant exchanges and swappers.
Freezes and refunds
Stablecoin issuers have frozen more than $2.4 billion of the stolen funds. Binance said it had replaced 90% of the stolen crypto and would reopen customer withdrawals in phases, starting with bitcoin.
Asked about the attack at the White House, President Donald Trump said "we're learning about it" and that his administration would talk to North Korea. TraderTraitor was also behind the roughly $1.5 billion Bybit hack in February 2025, previously the largest crypto theft on record.