FBI Pins $6 Billion Binance Theft on North Korea’s TraderTraitor, Publishes Hacker Wallet List

The FBI formally attributed the theft of more than $6 billion from Binance to North Korea in an alert dated Oct. 31, saying hackers it tracks as TraderTraitor carried out the attack on or about Oct. 29.

According to the alert, the bureau, the U.S. Secret Service and IRS Criminal Investigation have watched the hackers turn stolen assets mostly into ether, and expect them to keep laundering through DeFi and instant swap services. The three agencies asked crypto infrastructure providers, from THORChain and RPC node operators to instant exchanges, DeFi platforms, analytics firms and other service providers, to refuse transactions touching the listed wallets or funds that came from them.

The list names 19 Bitcoin addresses and one Solana address alongside 608 Ethereum addresses. The Secret Service pointed to the list in a Nov. 1 post, saying its investigators worked with industry partners within minutes of the attack to freeze “a significant portion of stolen cryptocurrency.”

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

The alert follows the template the FBI used after North Korea’s $1.5 billion Bybit hack, when it named TraderTraitor on Feb. 26, 2025, five days after that theft, and asked a similar set of services to block listed addresses. This time the bureau put its name to the attribution two days after a theft roughly four times larger, giving exchanges and node operators a government list to act on rather than only private-sector findings.

Blockchain analytics firms reached the same conclusion before the FBI did. TRM Labs linked the attack to TraderTraitor on Oct. 29, and Chainalysis said on Oct. 30 it had watched Binance funds mix onchain with money from September’s Bitget theft, which had also been tied to North Korea.

Chainalysis said funds began leaving Binance hot wallets around 4:20 p.m. ET on Oct. 29, that the unauthorized transfers came to about $6.4 billion, and that freezes began by 5:14 p.m. ET. It put the frozen total at about $2.8 billion. The firm also flagged signs of automated laundering, with many addresses receiving exactly 1 TRX before passing funds along.

On Nov. 1, Chainalysis said the launderers had moved more than $500 million through over 1,000 TRON addresses and had started shifting funds onto Solana.

The FBI asked anyone with information to contact a local field office or its Internet Crime Complaint Center.

Related Listen: Can THORChain Stop North Korea’s Laundering? Its Co-Founder Says It’s Too Decentralized

{"@context":"http:\/\/schema.org\/","@id":"https:\/\/unchainedcrypto.com\/fbi-pins-6-billion-binance-theft-on-north-koreas-tradertraitor-publishes-hacker-wallet-list\/#arve-youtube-iplfv7vuwpu","@type":"VideoObject","embedURL":"https:\/\/www.youtube-nocookie.com\/embed\/IPLfV7vuwpU?feature=oembed&iv_load_policy=3&modestbranding=1&rel=0&autohide=1&playsinline=1&autoplay=0"}

The post FBI Pins $6 Billion Binance Theft on North Korea’s TraderTraitor, Publishes Hacker Wallet List appeared first on Unchained.