FBI blames North Korea’s TraderTraitor for $6bn Binance hack as stablecoin issuers freeze billions

North Korea’s TraderTraitor operation stole more than $6 billion from Binance, the FBI said in an October 31 security alert, while Tether and Circle froze roughly $3 billion of the stolen stablecoins and hackers moved to evade the freezes.

Key takeaways

• The FBI’s October 31 alert attributes the October 29 Binance hack to TraderTraitor, also known as Lazarus Group, and lists hundreds of addresses for service providers to block.
• Tether froze about $971 million in USDT and Circle about $823 million in USDC tied to Binance hot wallet outflows, per reports of the issuers’ actions on October 29.
• Chainalysis says roughly $2.8 billion in issuer freezes had accumulated by October 31 and traced about $500,000 through a laundering method built on unfreezable DeFi receipt tokens.
• Binance has not confirmed the North Korea attribution itself and says it is working with law enforcement to identify the criminals.

The alert states that TraderTraitor, a North Korean operation also known as Lazarus Group, was responsible for the theft of more than $6 billion from the exchange. It lists hundreds of cryptocurrency addresses tied to the theft and urges THORNode operators, RPC node operators, DeFi platforms, instant exchanges and other service providers to block transactions involving those wallets.

Binance itself has not attributed the attack to any state. In a statement, the exchange said: “We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.” Its co-CEO, Richard Teng, said the intrusion started with a compromised engineer’s laptop, and that “our investigation has not attributed responsibility to any individual. So far, we have found no evidence of any wallet private key leak.”

As Binance’s estimate of the loss stands at $6.3 billion, the freeze effort touched close to half of it. Tether blacklisted about $971 million in USDT tied to outflows from Binance’s hot wallets on October 29, and Circle froze around $823 million in USDC, according to reports of the issuers’ actions that day. Freezing is a routine step for both issuers, who block addresses they suspect are linked to theft.

The issuers’ grip has limits. Chainalysis described a laundering method that surfaced on Tron in the early hours of the attack: the hackers swap TRX into stablecoins, deposit those stablecoins in DeFi lending protocols and receive receipt tokens, claims on pooled assets that issuers cannot freeze. The funds then move to clean wallets and bridge off Tron as ETH. Chainalysis traced about $500,000 through that process step by step, and said Circle and Tether had already contributed to $2.8 billion in freezes by October 31, a figure that includes freezes beyond those two issuers’ early moves.

The FBI’s blocklist depends on voluntary compliance, and the response has been mixed. THORChain co-founder Chad Barraford said in a November 1 post on X that its node operators “have zero information that isn’t already public and readily available in real time. No subpoenas required, a best case scenario for investigations.” The protocol refused a similar request in September, after Bitget lost $388 million.

Binance.US, which serves American traders, said its platform is not affected by the incident, which concerns Binance.com.