The Federal Bureau of Investigation has confirmed that North Korea’s TraderTraitor hacking group carried out a massive cyberattack on Binance, resulting in the theft of approximately $6.4 billion in digital assets. The agency called on the crypto industry to block hundreds of wallet addresses linked to the incident, warning that the number of addresses used by the attackers is rapidly increasing.
FBI identifies TraderTraitor as source of Binance breach
On Saturday, the FBI identified North Korea’s TraderTraitor as the group responsible for the Binance breach, one of the largest thefts in the cryptocurrency sector to date. TraderTraitor is a subunit of the Lazarus Group, a cybercrime syndicate notorious for executing high-profile crypto exchange hacks with ties to the North Korean state.
Mini dictionary: TraderTraitor — A North Korean hacker group specializing in targeting cryptocurrency firms, with documented links to the larger Lazarus Group. The group frequently uses social engineering attacks and malware to breach digital asset platforms.
The FBI stated that the hackers had already converted a significant portion of the stolen funds to ether and are actively using swap services and decentralized finance (DeFi) tools to move assets through the blockchain ecosystem.
FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.
Hundreds of addresses flagged, laundering spreads through DeFi
The FBI’s list includes over 600 flagged Ethereum addresses, fewer than 20 Bitcoin addresses, and a single Solana address suspected of holding or having moved funds from the Binance hack. Despite this, Chainalysis, a leading blockchain analytics firm, has reported that the attackers have already made use of thousands of addresses to facilitate the laundering of assets.
Binance, the world’s largest cryptocurrency exchange, was hacked on Thursday, with several analytics firms and commentators quickly attributing the breach to North Korea’s TraderTraitor. Following the attack, stablecoin issuers froze more than $2.4 billion of the stolen funds, yet significant amounts continue to circulate through decentralized channels.
Binance announced on Saturday that it had replenished 90% of the compromised digital assets and scheduled customer withdrawal services to resume on Sunday.
| Stolen Funds | Addresses Listed by FBI | Funds Frozen | Assets Replenished by Binance |
|---|---|---|---|
| $6.4 billion | 600+ (Ethereum), | $2.4 billion | 90% |
Chainalysis warns of expanding laundering network
Jonathan Levin, CEO of Chainalysis, emphasized that while hundreds of addresses have been identified, the laundering effort by the hackers is rapidly growing in scale.
Chainalysis anticipates that tens of thousands of addresses will be used in the upcoming weeks as the laundering operation expands. The attackers are pushing funds through a broader network, including bridges, instant exchanges, and swappers, given the volume is too great for their trusted laundering venues to handle. They are also deploying novel automated mechanisms to obfuscate the fund trail.
Chainalysis detailed in a Friday blog post that transaction patterns suggest the use of automation to move funds between addresses, making tracing the stolen assets more challenging for investigators.
US government response and ongoing investigation
When questioned about the hack, US President Donald Trump said that his administration is monitoring the situation and would engage with North Korea on the matter. The USSS and IRS Criminal Investigation division are supporting the effort, alongside the FBI, to stop further laundering and recover stolen funds.
The investigation into the attack is ongoing as authorities and blockchain companies work to track asset movement and prevent further laundering by the actors involved.
