FBI Flags Over 600 Addresses Tied to North Korea's Binance Heist

The FBI has formally blamed North Korean state- hackers for the record-breaking Binance cryptocurrency heist and is asking the crypto industry to help stop the stolen funds from being laundered.

The attack was conducted on October 29. Hackers emptied Binance hot wallets on multiple blockchains, moving most of the funds out within roughly 20 minutes. Binance estimates the impact at roughly $6.3 billion, the largest crypto theft on record.

Within hours, blockchain intelligence firms TRM Labs and Chainalysis linked the attack to the North Korean group TraderTraitor. Binance initially said the intrusion may have started with a DevOps engineer’s compromised laptop, and pledged to cover all losses.

The FBI released its attribution on October 31, two days after the theft.

“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages,” the agency said.

The alert names 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address that currently hold, or previously held, proceeds of the theft.

Together with the Secret Service and IRS-CI, the FBI called on THORChain node operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms to refuse transactions linked to these addresses.

The FBI previously blamed the same group for the $1.5 billion Bybit hack in February 2025.

Binance says the attack went beyond one laptop

Binance has since expanded on its early findings. “Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach,” Binance co-CEO Richard Teng said in a statement .

Teng described the incident as a complex attack that “was not carried out by one person.” He said the attacker also deployed a self-destruct mechanism that wiped its tooling and evidence, complicating the investigation.

He said the attacker’s use of Ethereum’s EIP-7702 delegation feature “did not pass through our normal approval controls.” Binance has not yet detailed the additional breach points, and has promised a technical post-mortem once the facts are verified.

Binance began a phased resumption of withdrawals on November 1, starting with the Bitcoin network. By mid-morning on Sunday, it said it had processed $4.6 billion in withdrawals and $1 billion in deposits.

According to the exchange, 95% of the stolen amount has now been replaced using company funds, and Binance is buying the remaining less liquid tokens on the market and through over-the-counter deals.

“Our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users,” Teng said.

Laundering appears to be automated

Blockchain analytics firm Elliptic puts the theft at $6.43 billion across 11 blockchains. Of that, it has confirmed $2.85 billion as frozen or seized on-chain.

According to Elliptic’s latest figures , the attacker controls $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses. These include roughly 584,000 ETH, 18,327 BTC and 233 million XRP.

“In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep,” Elliptic said.

The main wallet distributing funds on Tron kept paying out hourly for more than a day, around the clock. When a cross-chain bridge refused deposits, the system rerouted the money to the same destination through freshly created wallets.

Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.

Chainalysis also reported laundering patterns indicating automation , including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.

Related : $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack

Related : Hackers Return $263 Million Stolen From Liquid Network

$2 Million+ Drained From Polymarket Traders in New Supply Chain Attack

Malicious code linked to a website monitoring tool was designed to hijack logged-in Polymarket sessions and siphon user funds.

$6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor

Blockchain analysts link the record crypto theft to North Korean hackers, as Binance probes a possibly compromised engineer laptop.

Supply Chain Security

$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant

A small circuit board hidden under the signers’ screens read user data and transmitted it to the attackers.

North Korea Suspected in $351 Million Bitget Crypto Heist

Bitget’s security systems caught the unauthorized transfers on September 24, and some wallet addresses linked to the attacker have been frozen.

Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack

Hackers compromised the Brevo marketing platform and used that access to send phishing emails to users of Trezor, BitBox, and CoinTracking.

40,000 Impacted by SafePal Data Breach

Hackers exploited a vulnerability in the order-tracking function of a plugin to access SafePal customer information.

Artificial Intelligence

Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments

Researchers uncovered two campaigns embedding indirect prompt injections in malicious websites to exploit autonomous AI agents browsing the web.

$3 Million Reportedly Stolen in Polymarket Hack

The decentralized prediction market said hackers targeted some of its users through a compromise of a third-party vendor.