FBI says North Korea's TraderTraitor group stole $6 billion from Binance, asks crypto services to block funds

FBI confirms North Korea behind $6 billion Binance theft

The U.S. Federal Bureau of Investigation (FBI) has confirmed that North Korea's TraderTraitor hacking group carried out the theft of more than $6 billion from Binance, the world's largest crypto exchange. In a notice released on Saturday, the FBI asked parts of the crypto industry to block transactions linked to the stolen funds.

TraderTraitor is a subunit of the Lazarus Group, a hacking group known for past breaches of crypto exchanges, according to the report. Binance was hacked on Thursday, losing about $6.4 billion.

Key points from the FBI notice

• The FBI listed hundreds of wallet addresses — a wallet address is a string of characters used to send and receive crypto — that currently hold or at some point held money from the hack.
• The notice included over 600 Ethereum addresses, just under 20 Bitcoin addresses, and one Solana address.
• The hackers have mainly been converting the stolen funds into ether, the token of the Ethereum network.
• The FBI expects the attackers to keep laundering the money using swap services and other decentralized finance (DeFi) tools, which are services that let users trade crypto without a central company in between.

What the FBI statement says

The FBI, along with the U.S. Secret Service (USSS) and IRS Criminal Investigation, is urging private sector groups to block the tainted funds. These include THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers.

The agencies asked them to refuse transactions "with or derived from addresses" that the TraderTraitor actors are using to launder the stolen assets.

Analysts say far more addresses are involved

Chainalysis, a blockchain analytics firm, said the list is likely just the start. Chainalysis CEO Jonathan Levin said the attackers have already used "thousands of addresses."

"We anticipate this will become tens of thousands over the coming weeks as money is transferred through a broader money laundering network," Levin said. He added that the thieves have too much money for their usual laundering channels to handle, so the funds will move through services like bridges, instant exchanges, and swappers. He also said the attackers are using "novel automated laundering mechanisms."

What is confirmed and what is not

According to the reporting, several facts are confirmed: the FBI attributed the hack to North Korea's TraderTraitor group, the theft totaled over $6 billion, and the agency published a list of hundreds of addresses tied to the stolen funds.

It is also reported that stablecoin issuers — companies that issue tokens tied to the value of regular money — froze over $2.4 billion of the stolen funds. However, the attackers have continued laundering much of the rest. Binance said earlier on Saturday that it had replaced 90% of the stolen cryptocurrencies and planned to resume customer withdrawals on Sunday.

The exact number of addresses the attackers will use is not settled. The FBI listed several hundred, while Chainalysis expects the total to reach tens of thousands in the coming weeks.

Why this matters for crypto users and services

The FBI notice gives exchanges, DeFi services, and analytics firms specific addresses to block, which could make it harder for the hackers to move the stolen money. For Binance customers, the exchange's statement that it has replenished 90% of the stolen crypto and plans to reopen withdrawals on Sunday is the most direct update on access to their funds.

Chainalysis's forecast suggests the laundering effort is still ongoing, meaning new addresses tied to the stolen funds may continue to appear.

Sources

• CoinDesk

Read also: CFTC Chair Argues Binance Hack Proves Need for US Oversight of Offshore Exchanges

Read also: Chainalysis hit by cybersecurity incident, says customer data exposed

Read also: Inside the $6.3 billion Binance hack — the largest crypto heist on record

Read also: Secret Service and FBI Join Binance Hack Probe as Circle Freezes $823 Million

Read also: Binance hit by record $6.3B hack; $3B frozen, withdrawals restart within 40 hours