The FBI has formally blamed North Korea for the theft of more than $6 billion from Binance, the largest crypto hack on record. In a security notice published Saturday, the bureau said the Oct
The FBI has formally blamed North Korea for the theft of more than $6 billion from Binance, the largest crypto hack on record.
In a security notice published Saturday, the bureau said the October 29 attack on the world's largest crypto exchange was carried out by hackers it tracks as TraderTraitor, its name for North Korean state-sponsored crypto theft teams.
TheStreet's senior editor Mehab Qureshi argued in an op-ed hours after the breach that the frozen-asset figure was the wrong number to watch, because the gap between what was taken and what was caught decides the damage. Read our op-ed on the hack.
The FBI, working with the U.S. Secret Service and the IRS's Criminal Investigation division, says it has already watched the attackers moving the money.
"The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH)," the notice said.
Ether is the second-largest cryptocurrency after bitcoin. The bureau expects the stolen funds to be pushed through DeFi, short for decentralized finance, and instant swap services, which let users trade tokens without a traditional exchange account, "as they prepare them for further laundering stages."
The FBI's cyber branch also posted the alert publicly at 6:36 p.m. ET Saturday.
Suspected North Korea-linked actors account for nearly 89% of reported crypto hack losses so far this year, up from 15% in 2021. Source: ChainalysisThe notice publishes hundreds of Ethereum wallet addresses and 19 bitcoin addresses that the FBI says are holding, or have held, assets from the theft.
The agencies want the crypto industry to treat those wallets as radioactive. THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers are being urged to block transactions with, or derived from, the listed addresses.
Node operators and swap services are the plumbing that moves crypto between blockchains. If enough of them refuse the flagged funds, the attackers are left holding assets they cannot easily sell or spend.
The FBI published the full list of addresses on its website and asked anyone with information to contact a local FBI field office or its Internet Crime Complaint Center at ic3.gov.
The FBI's confirmation makes official what blockchain investigators had been saying since the early hours of Friday.
Chainalysis, a blockchain analytics firm that tracks illicit crypto flows, attributed the theft to TraderTraitor at 12:30 a.m. ET Friday. It put the haul at roughly $6.4 billion at the time of the theft, higher than Binance's own $6.3 billion estimate, and said stolen Binance funds were commingling on-chain with assets taken in last month's Bitget exploit, a September theft also tied to North Korean actors.
TraderTraitor is not a new name at the FBI. The bureau used the same label when it blamed North Korea for the $1.5 billion Bybit hack in February 2025, until this week the largest crypto theft ever recorded.
Chainalysis has called the Binance theft not only the largest in crypto history but one of the single-largest financial crimes of all time.
How did hackers drain $6.3 billion from Binance in about 20 minutes (3:39)Binance, which disclosed the breach Thursday, says attackers used a compromised employee laptop to submit unauthorized withdrawal transactions. It has said from the start that users will not bear the loss, and it is working with law enforcement on the recovery.
The exchange said Saturday it has covered about 90% of the impacted assets using its corporate treasury, part of its $1 billion Secure Asset Fund for Users and a portion of its futures insurance fund. It is buying the rest through market and over-the-counter channels, private deals arranged away from exchanges.
"We will continue to purchase other altcoin assets that are not yet 100% matched through market and over-the-counter (OTC) channels until the replenishment ratio for all tokens reaches 100%," co-CEO Yi He wrote.
Withdrawals remain paused, but Binance says they are on track to resume within its stated timeframe. Deposits have operated normally throughout the incident.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
Cryptocurrency investments are highly volatile and risky. Always conduct your own research before making any investment decisions.
