FBI ties $6 billion Binance theft to North Korean hacking group
Security & Exploits ·
Federal investigators say the TraderTraitor group, linked to North Korea, carried out the theft and are now pressing crypto infrastructure providers to cut off the laundering trail.
The FBI has formally assigned responsibility for the loss of more than $6 billion in digital assets from Binance to hackers operating out of North Korea, naming the operation TraderTraitor, according to wublockchain.xyz. The figure makes it one of the largest crypto thefts attributed to a state-linked actor to date.
Working alongside the US Secret Service and IRS Criminal Investigation, the bureau said the attackers have been funneling the stolen holdings largely into ETH, a step typically used to simplify further movement across chains and platforms. Investigators expect the group to continue routing funds through decentralized finance protocols and instant-swap services designed to obscure the origin of funds quickly.
In response, the three agencies issued a joint appeal to a wide swath of the crypto ecosystem — THORNode operators, RPC node operators, instant exchanges, DeFi services, and blockchain analytics firms — asking them to block any transaction tied to or derived from wallet addresses connected to the attackers. The FBI released a corresponding list of addresses either controlled by or closely associated with the hackers that have held or currently hold the stolen assets, giving service providers a concrete basis for screening transactions.
The request reflects a broader concern that stolen funds are being pushed through decentralized channels precisely because they lack the centralized choke points exchanges rely on to freeze suspicious transfers. Related reporting has pointed to attempts to move stablecoins through Tron-based protocols, another avenue investigators want DeFi platforms and node operators to monitor and block before assets can be cashed out or further laundered.
The episode has drawn coverage across multiple outlets, with at least six distinct sources confirming the North Korea attribution and the scale of the theft. What remains unclear is how much of the $6 billion has already moved beyond the reach of the published address list, and whether DeFi protocols and RPC operators will adopt the FBI's blocking requests widely enough to materially slow the laundering effort already underway.