The FBI officially confirmed on 31 October that North Korea is behind the theft of more than $6 billion from Binance on 29 October. Investigators call the activity TraderTraitor and are urging the industry to block the addresses used to move the stolen funds.
Binance, the world's largest crypto exchange, was hit on Friday evening by what is likely the largest crypto theft on record, with a loss the company itself has estimated at around $6.3 billion. In the days that followed, blockchain analysis firms TRM Labs and Chainalysis pointed to the North Korean hacking group TraderTraitor, linked to the state-backed Lazarus Group, as the likely perpetrator, based on technical traces in the attack. That assessment has now moved from private analysis to official confirmation: the FBI, together with the United States Secret Service (USSS) and IRS Criminal Investigation (IRS-CI), issued a notice on 31 October naming North Korea responsible.
In the notice, the FBI states that North Korea (the Democratic People's Republic of Korea) was responsible for the theft of more than $6 billion in virtual assets from Binance, on or about 29 October. The FBI refers to the specific activity as "TraderTraitor."
The FBI, together with the USSS and IRS-CI, says it has observed TraderTraitor actors converting the stolen assets primarily into ether (ETH). Investigators expect the group to now attempt further laundering through DeFi services and so-called instant swap services, where crypto can be exchanged quickly without full customer checks.
The FBI's attribution is the first official one from U.S. authorities in the case, but it confirms what blockchain analysis firms had already concluded. Chainalysis described in its blog post how the attack used EIP-7702 authorizations and was funded through an operational wallet linked to the mixing service Tornado Cash, and pointed to overlap with funds from the earlier Bitget hack, which is also attributed to North Korea.
TRM Labs reached the same conclusion in its own analysis, with a more detailed technical breakdown of the mechanism: 50 pre-signed authorizations spread across several blockchains, and laundering through discounted market-maker sales, loans on Aave, and what TRM describes as a "BTC peel chain" — a method where bitcoin is moved on in progressively smaller amounts to make tracing harder. TRM also noted that the evidence points to a breach in Binance's own signing infrastructure, though the company has not disclosed a root cause.
The FBI, USSS and IRS-CI are urging private-sector entities to block transactions to or from the addresses TraderTraitor actors are using to launder the stolen assets. The appeal is directed specifically at operators of THORNode (the nodes that run the THORChain exchange protocol), RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers.
As part of the notice, the FBI has published a list of specific addresses that have held or continue to hold funds from the theft, which investigators link directly to or closely with the North Korean TraderTraitor actors.
Sources: FBI, TRM, Chainalysis
You have read what you can read for free. With an account you get unlimited access to all news and articles on kaupr.io — and become part of the network of investors, professionals and builders following onchain finance.