FBI pins $6B Binance hack on North Korea's TraderTraitor, asks DeFi to block addresses

The FBI has formally attributed last week's theft from Binance — the largest crypto exchange by volume — to North Korea's TraderTraitor group, and is asking the on-chain economy to help freeze the stolen funds before they disappear.

In a statement on Saturday, Oct. 31, the FBI said TraderTraitor — a subunit of the Lazarus Group, which has carried out several high-profile exchange breaches — was behind the Thursday attack, according to CoinDesk. The bureau, alongside the U.S. Secret Service and IRS Criminal Investigation, urged "THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers" to block transactions tied to addresses the hackers are using to launder the money.

The FBI's notice listed over 600 Ethereum addresses, just under 20 Bitcoin addresses, and a single Solana address. It said the attackers have been converting the haul mainly into ether and expects them to lean on swap services and other DeFi tools to keep moving it.

That address list is already outdated, by one firm's account. Chainalysis CEO Jonathan Levin said in a statement the attackers have used "thousands of addresses" and he expects "tens of thousands over the coming weeks" as the funds flow through bridges, instant exchanges and swappers. Levin said the group has "too much money for their trusted laundering venues to handle" and is deploying "novel automated laundering mechanisms" — a claim consistent with a Chainalysis blog post on Friday noting transaction volumes that suggest automated circulation of funds between addresses to obscure the trail.

Binance, for its part, said earlier Saturday it had replenished 90% of the stolen crypto and planned to resume customer withdrawals on Sunday. Stablecoin issuers have frozen over $2.4 billion of the stolen funds, per CoinDesk, though the rest keeps moving.

Key facts

• Victim / date: Binance, hacked Thursday (CoinDesk).
• Amount: reported as "over $6 billion" and "$6.4 billion" within CoinDesk's own coverage — figures are not yet settled.
• Attribution: FBI confirmed North Korea's TraderTraitor, a Lazarus Group subunit (FBI statement, Oct. 31, via CoinDesk).
• Blocklist: 600+ ETH, under 20 BTC, 1 SOL address (FBI).
• Frozen: $2.4B+ by stablecoin issuers; Chainalysis says "thousands" of addresses in play, expects "tens of thousands."
• Recovery: Binance says 90% replenished, withdrawals to resume Sunday (self-reported).

The real-world read

Two cautions. First, the loss figure isn't fixed — CoinDesk's reporting carries "$6 billion," "$6.4 billion," and (in a sidebar headline) "$6.3 billion." Treat the number as an estimate in flux. Second, the "90% replaced, withdrawals resuming" line comes from Binance itself — the interested party — and hadn't been independently verified at publication. The gap between the FBI's few hundred addresses and Chainalysis's "thousands, heading to tens of thousands" also shows how far behind any static blocklist already is. President Trump, asked about the hack Saturday, said only that "we're learning about it" and would "talk to North Korea about it."

Opinion, and whose

• Chainalysis (Jonathan Levin): forecasts laundering will spread to tens of thousands of addresses via bridges and swappers, citing "novel automated" methods. A blockchain-analytics firm, which sells tracing services.

Sources

• CoinDesk (Tier 2, secondary), Oct. 31–Nov. 1 — reported the FBI attribution and blocklist, Chainalysis's figures and quotes, the $2.4B freeze, Binance's recovery claim, and Trump's remark; cited the FBI statement and Chainalysis as its primary sources. (The underlying FBI statement and Chainalysis blog post are primary; not read directly here.)

This is news reporting, not financial advice.