Press play to start listening
The FBI has attributed the theft of more than $6 billion from Binance to North Korea, naming the activity it tracks as TraderTraitor and publishing hundreds of cryptocurrency addresses connected to the stolen funds.
In an October 31 announcement, the bureau said the theft occurred on or around October 29, 2026. The attribution follows Binance’s disclosure that attackers stole approximately $6.3 billion, with its investigation identifying a compromised DevOps engineer’s laptop and additional breach points.
Stolen Assets Converted Into Ethereum
Investigators from the FBI, US Secret Service and IRS Criminal Investigation have observed the attackers converting stolen assets primarily into Ethereum. They expect further laundering through decentralised finance platforms and instant cryptocurrency swap services.
The agencies are asking cryptocurrency businesses and infrastructure operators to block transactions involving the listed addresses, including transactions carrying funds derived from them. Their appeal specifically includes THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics companies and other virtual asset service providers.
Those requests extend the response from identifying the attackers to restricting where the stolen cryptocurrency can move. Exchanges and other services handling the funds could help interrupt transfers as the attackers attempt to convert or redistribute them.
Binance Investigation Identified a Compromised Laptop
The FBI announcement follows two days of disclosures about the theft and Binance’s efforts to contain it. Hackread.com’s initial report covered outside estimates of up to $5.8 billion in suspicious transfers, before Binance placed the estimated impact at approximately $6.3 billion.
Binance also reported that around $3 billion had been verified as frozen through cooperation with law enforcement, token issuers and industry partners. Frozen assets cannot be treated as money already recovered by the exchange.
In its first detailed explanation, Binance said a compromised DevOps engineer’s laptop appeared to have allowed an attacker to access a service container and submit unauthorised withdrawal transactions. The exchange said it had found no evidence that wallet private keys had leaked.
As previously reported, Binance subsequently identified additional breach points without explaining them publicly. It promised to cover all losses and said it would release a technical report after completing its investigation.
The FBI’s attribution identifies who it holds responsible, but its announcement does not explain how the engineer’s laptop was compromised or provide a full account of the attack.
FBI Publishes 628 Cryptocurrency Addresses
The alert lists 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address. According to the FBI, these addresses hold or previously held assets from the theft and are operated by, or closely connected to, North Korean TraderTraitor hackers.
The complete list is available below, grouped by blockchain and preserving the FBI’s address order and capitalisation.
The bureau is also asking anyone with information about the theft to contact an FBI field office or submit a report through the Internet Crime Complaint Center. Its announcement does not provide a new figure for assets frozen or returned.
