FBI confirms North Korea's TraderTraitor behind $6.4B Binance hack, flags 600+ addresses
Author: Crypffalo Research · 09:53 01/11/2026
The FBI attributed the roughly $6.4 billion Binance hack to North Korea's TraderTraitor group and urged DeFi services, swap platforms and node operators to block more than 600 linked addresses.
The FBI has formally attributed the Oct. 29 Binance hack to TraderTraitor, a North Korean state-linked hacking group. It is the first official US confirmation after days of attribution by on-chain analytics firms.
In a notice issued Saturday, Oct. 31 (US time), the bureau put the theft at about $6.4 billion. It published more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address that it wants the industry to block.
Key takeaways
- Attribution: The FBI named TraderTraitor, a subunit of North Korea's Lazarus Group.
- Scale: About $6.4 billion per the FBI; Binance earlier reported $6.3 billion.
- Blocklist: More than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address.
- Frozen funds: Stablecoin issuers have frozen more than $2.4 billion of the stolen assets.
- Binance status: The exchange says it has replenished 90% of the losses and aims to reopen withdrawals on Nov. 1.
What the FBI said
The notice was issued jointly with the US Secret Service (USSS) and IRS Criminal Investigation. The agencies asked private-sector firms to block transactions with, or derived from, addresses TraderTraitor is using to launder the funds.
The call targets THORChain node operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms. In practice, the FBI is trying to choke off the gateways the hackers need to cash out.
According to the bureau, much of the stolen crypto has already been converted into ether. It expects the attackers to keep using swap services and DeFi tools to move funds through multiple layers.
The laundering race is just starting
Chainalysis CEO Jonathan Levin said the FBI list is only the visible part. The attackers have already used "thousands of addresses," he said, and that could grow to tens of thousands in the coming weeks.
Levin argued the haul is too large for the group's trusted laundering venues to absorb. That should push funds into a wider network of bridges, instant exchanges and swappers.
Chainalysis also flagged "novel automated laundering mechanisms." Funds are being cycled rapidly between addresses before moving on, an apparent attempt to obscure the trail.
Timeline so far
- Oct. 29: Unusual outflows hit Binance wallets; the exchange pauses withdrawals on several networks.
- Oct. 30: Binance confirms a $6.3 billion hack and sets aside $6.34 billion of company funds; TRM Labs and Chainalysis point to North Korea.
- Oct. 30: The FBI and Secret Service join the probe; Tether and Circle freeze part of the stolen funds.
- Oct. 31: Binance says 90% of the assets have been replenished and keeps its Nov. 1 withdrawal target.
- Oct. 31 (US time): The FBI formally attributes the hack to TraderTraitor and releases its address list.
What it means for crypto markets
Markets took the confirmation in stride. As of around 9:50 a.m. GMT+7 on Nov. 1, bitcoin traded near $77,600, up about 0.4% over 24 hours per CoinGecko, while ETH hovered near $2,270 and BNB near $700.
- Bull case: The FBI blocklist helps exchanges and protocols freeze more funds, limiting how much stolen crypto can hit the market; a smooth withdrawal restart at Binance would bolster confidence.
- Risk case: The hackers hold a large ETH stash that could be routed through DeFi and sold over time, weighing on ether; any delay or glitch in Binance withdrawals could sour sentiment.
The episode also adds weight to calls for tighter US oversight of offshore exchanges, a point the CFTC raised earlier.
What to watch next
- Whether Binance reopens withdrawals on schedule on Nov. 1, and how much users pull out.
- Additional freezes after the FBI address list circulates.
- ETH flows from attacker wallets through bridges, THORChain and instant exchanges.
- Liquidation activity on our real-time liquidations page and key dates on the economic calendar.
Frequently Asked Questions
Who is TraderTraitor?
It is a subunit of the Lazarus Group, the hacking collective tied to the North Korean state. The group targets crypto firms using social engineering and malware.
Will Binance users lose money?
Binance says it will cover all losses with company funds and has already replenished 90%. Users should follow the exchange's official announcements on the withdrawal restart.
Does the FBI list help recover the funds?
It helps services block transactions and freeze more assets. Actual recovery, however, typically takes a long time and is rarely complete.
*This content is for information only and is not financial advice.*
Tags: Binance, Hack, FBI, North Korea, Security
Related articles
- Chainalysis discloses breach, hackers accessed customer names and emails
- Binance replaces 90% of stolen crypto after $6.3B hack, eyes Sunday withdrawals
- Bitcoin ETFs See $643M Outflow, Largest Since June After Binance Hack
- Trump says US looking into Binance hack as CFTC chair pushes offshore oversight
- Binance targets Nov 1 withdrawal restart after finding more breach points in $6.3B hack
- Crypto stocks slide: Coinbase drops 12%, Strategy 11% as Binance hack weighs