The FBI, the US Secret Service and IRS Criminal Investigation have formally attributed the theft of roughly $6.3 billion from Binance to North Korea’s TraderTraitor group. The agencies also published 628 cryptocurrency addresses that hold or previously held the stolen funds, while Binance’s co-CEO said investigators have found more points of breach than the company first reported.
FBI Alert Names 628 Addresses Tied to the TraderTraitor Binance Theft
The joint alert, issued on October 31, says the theft occurred on or about October 29. It identifies TraderTraitor, a group also tracked as Lazarus Group, Jade Sleet and APT38, as responsible. Blockchain firms TRM Labs and Chainalysis had linked the attack to the same group within hours of Binance disclosing the loss on October 30.
The address list is split across three networks: 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address. The agencies say TraderTraitor is converting the stolen assets mostly into Ethereum and expect further laundering through decentralized finance protocols and instant swap services.
Which Services the Agencies Asked to Block TraderTraitor Transactions
The alert asks THORChain node operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms to block transactions connected to the listed addresses. Several decentralized platforms have said publicly that they cannot stop transactions, which limits how far the request can reach.
Reporting on the laundering activity describes thousands of apparently automated transactions meant to obscure the movement of funds. The scale of that activity shows why the agencies are targeting intermediaries rather than the attackers’ wallets alone.
Secret Service Says Freezes Covered a Significant Share of Binance Funds
The Secret Service says it worked with industry partners and the Justice Department within minutes to freeze a significant share of the funds. Blockchain analysts put the frozen total near $3 billion, which would be roughly half of the amount taken. The remainder is reportedly being laundered.
Binance Co-CEO Says the Compromised Laptop Was Not the Whole Story
Binance co-CEO Richard Teng said the company’s initial finding of a “compromised laptop” was incomplete and that later work found “additional points of breach.” He described a complex attack that was “not carried out by one person” and said the attacker used a self-destruct mechanism that wiped tooling and evidence.
Binance has not changed its core account of how the withdrawals happened: access from a DevOps engineer’s laptop reached a service container, and that container submitted unauthorized withdrawals. The company found no evidence that wallet private keys were stolen. Binance suspended the platform for several days and used reserve funds to replace the stolen coins, so customers are not bearing the loss.
Why Reported Totals Range From $6 Billion to Over $6.4 Billion
The loss figure differs by source. Binance says roughly $6.3 billion, and the FBI says more than $6 billion. Other reporting on the theft cites roughly $6.36 billion to $6.43 billion across ten blockchains, with most of the funds moved in about 20 minutes.
Bybit, Bitget and Drift Place the Binance Theft in a North Korean Pattern
The FBI previously blamed TraderTraitor for the $1.5 billion Bybit hack in February 2025. Coverage of the Binance attribution also lists the $387.5 million Bitget theft from September 2026 and the $280 million Drift hack from April 2026 as North Korea-linked incidents. The Binance theft is the largest crypto theft on record, ahead of Bybit.
The investigation into how an attacker got from one engineer’s laptop to a withdrawal-signing container is still open, and the published address list gives exchanges and analytics firms a concrete set of identifiers to monitor as the remaining funds move through swap services.
