FBI Links Binance Hack to North Korea Group

What to Know

The FBI confirmed that North Korea's TraderTraitor hacking group was behind the theft of over $6 billion from Binance.
The bureau identified hundreds of addresses that currently hold or at some point held funds tied to the Binance hack.
The FBI urged private sector crypto entities, including DeFi services, instant exchanges, RPC node operators, THORNode operators, blockchain analytics firms, and other virtual asset service providers, to block transactions tied to the listed addresses.
The hackers have been converting stolen funds mainly into ether, while authorities expect the use of swap services and other decentralized finance tools to continue.
The FBI notice listed over 600 Ethereum addresses, just under 20 Bitcoin addresses, and a single Solana address.
Binance was hacked on Thursday and lost some $6.4 billion in an attack several analytics services and individuals attributed to North Korea's TraderTraitor group.
Stablecoin issuers froze over $2.4 billion of the stolen funds, while laundering activity has continued across the remainder.
Binance said it had replenished 90% of the stolen cryptocurrencies and planned to resume customer withdrawals on Sunday.
Chainalysis said the attackers have already used thousands of addresses and expects the number to become tens of thousands in the coming weeks.

FBI Confirms TraderTraitor Link to Binance Breach

The U.S. Federal Bureau of Investigation has confirmed that North Korea's TraderTraitor hacking group was behind the theft of over $6 billion from Binance, intensifying one of the largest security crises to hit the crypto sector. The confirmation places the breach within a wider pattern of state linked cyber activity targeting digital asset platforms, liquidity venues, and infrastructure providers.

The FBI said hundreds of blockchain addresses either currently hold or at some point held funds connected to the Binance hack. The bureau asked the crypto industry to block transactions involving those addresses or funds derived from them, signaling an urgent attempt to slow the movement of stolen assets across decentralized and centralized market infrastructure.

The Binance incident has become a major test for the crypto industry's ability to coordinate quickly across exchanges, analytics firms, stablecoin issuers, node operators, bridges, swappers, and DeFi protocols. Unlike traditional finance, where intermediaries can freeze accounts through centralized channels, crypto laundering can move through many permissionless tools in rapid succession, forcing investigators and compliance teams to track funds in real time.

Authorities Ask DeFi and Crypto Infrastructure Providers to Act

The FBI, along with the U.S. Secret Service and IRS Criminal Investigation, urged private sector entities to block transactions connected to addresses used by TraderTraitor actors. The call was directed at THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers.

The wording of the request is notable because it extends beyond centralized exchanges. Authorities are also focusing on infrastructure layers and decentralized services that may not operate like conventional custodial platforms. That reflects the complexity of modern crypto laundering, where stolen assets may pass through swap tools, bridges, automated routing systems, and a wide range of services before reaching a more liquid exit point.

The FBI said the attackers had been converting the stolen funds mainly into ether. It also said it expects the hackers to use swap services and other decentralized finance tools to continue laundering the funds. That expectation aligns with recent laundering patterns in major crypto exploits, where attackers often break large balances into smaller flows and route them through several chains, services, and wallet clusters.

Address List Covers Ethereum, Bitcoin, and Solana

The FBI listed over 600 Ethereum addresses, just under 20 Bitcoin addresses, and a single Solana address in its notice. The address list represents only a snapshot of wallets believed to be connected to the stolen funds, not necessarily the full scope of laundering activity.

Chainalysis Chief Executive Jonathan Levin said the attackers have already used thousands of addresses. He said the number is expected to become tens of thousands over the coming weeks as money is transferred through a broader laundering network. That projection suggests investigators may face a rapidly expanding web of wallet activity as the attackers attempt to dilute traceability and reach new liquidity routes.

Levin said the attackers have too much money for their trusted laundering venues to handle. As a result, he said the money will flow to a wider network of services, including bridges, instant exchanges, and swappers, because a wider set of money launderers will be needed. The statement points to a key operational constraint for major crypto thieves: moving extremely large sums can create liquidity, compliance, and surveillance problems even for sophisticated laundering networks.

Automated Laundering Adds Pressure on Investigators

Chainalysis said the attackers are using novel automated laundering mechanisms. The firm said transaction volume indicated the use of automated tools designed to obscure the trail of funds by circulating assets between addresses before sending them onward.

Automated laundering can make blockchain tracing more difficult, but it does not make transactions invisible. Public blockchains still record transfers, wallet interactions, and asset movements. The challenge for investigators is speed, scale, and interpretation. When thousands of addresses are created or activated in short periods, compliance teams must rapidly determine which flows are connected, which services are exposed, and which assets may still be recoverable.

For DeFi platforms and infrastructure providers, the episode raises difficult questions about blocking, screening, and operational responsibility. Some services can block specific wallets or interface access. Others may be more limited because their smart contracts are autonomous or because node and routing infrastructure does not hold user assets directly. Still, the FBI's appeal shows that authorities expect a broad response from the crypto ecosystem when state linked laundering is identified.

Binance Moves to Restore Operations

Binance said it had replenished 90% of the stolen cryptocurrencies and planned to resume customer withdrawals on Sunday. The exchange's statement is a critical part of market confidence, as withdrawal access is often the most closely watched signal after a major exchange breach.

The platform was hacked on Thursday and lost some $6.4 billion in the attack. Several analytics services and individuals attributed the breach to North Korea's TraderTraitor hacking group before the FBI confirmation. TraderTraitor is described as a subunit of the Lazarus Group, which has been tied to a number of high profile crypto exchange breaches.

Stablecoin issuers froze over $2.4 billion of the stolen funds, reducing the amount immediately available for laundering. Even so, the attackers have continued moving much of the remainder. Stablecoin freezes can be effective when stolen assets remain in tokens with centralized issuers, but attackers often try to convert funds into assets or routes that are harder to freeze.

Why the Case Matters for Crypto Markets

The Binance hack underscores the systemic importance of exchange security, wallet controls, and cross sector coordination. Binance is the world's largest crypto exchange, and an attack of this scale can ripple across market sentiment, counterparty risk assessment, and regulatory scrutiny.

For traders, the immediate concern is whether affected platforms can maintain liquidity, process withdrawals, and prevent contagion. For compliance teams, the issue is identifying exposure to tainted funds before they reach customer accounts or liquidity pools. For regulators and law enforcement, the case highlights how state linked actors may exploit open blockchain infrastructure while still leaving a traceable public record.

The incident may also increase attention on DeFi screening practices. Decentralized protocols have long faced pressure to balance permissionless access with safeguards against sanctioned or stolen funds. The FBI's request places renewed emphasis on transaction monitoring, address screening, and cooperation between analytics providers and market infrastructure operators.

North Korea Cyber Activity Remains a Central Concern

The FBI's confirmation places the Binance breach within a broader security challenge involving North Korea linked hacking groups. TraderTraitor's connection to the Lazarus Group is significant because Lazarus has been associated with high profile crypto exchange breaches and sophisticated laundering methods.

Crypto assets are attractive targets for advanced hacking groups because stolen funds can be moved quickly across borders, converted through liquid markets, and routed through decentralized infrastructure. At the same time, blockchain transparency gives investigators tools that are not available in many traditional financial channels. The outcome often depends on whether authorities, exchanges, issuers, and analytics firms can act before funds are fully dispersed.

U.S. President Donald Trump said officials are learning about the hack and added that his administration would talk to North Korea about it. The comment signals that the incident may remain not only a crypto enforcement matter but also a diplomatic and national security issue.

Market Focus Turns to Laundering Routes

Market participants are now watching where the stolen assets move next. Bridges, instant exchanges, swap services, and other DeFi tools are likely to remain under close scrutiny as investigators follow the laundering trail. Because the attackers are expected to use more addresses over time, address lists may need frequent updates to remain useful.

The scale of the alleged laundering network also means that crypto businesses may face a moving target. A wallet that appears clean at one moment may later receive funds linked to the hack, while tainted assets may be split, routed, and recombined in ways that complicate risk scoring. That makes cooperation between blockchain analytics firms and service providers central to containing further movement.

For the broader industry, the Binance hack is a reminder that security is not only about preventing breaches. It is also about response speed, asset recovery, coordination, and the ability to limit laundering after funds leave the original venue. The coming weeks may determine how much of the remaining stolen crypto can be slowed, frozen, traced, or recovered.

Frequently Asked Questions (FAQs)

Who does the FBI say was behind the Binance hack?

The FBI says North Korea's TraderTraitor hacking group was behind the theft of over $6 billion from Binance. TraderTraitor is described as a subunit of the Lazarus Group.

How much did Binance lose in the hack?

Binance lost some $6.4 billion in the attack. The FBI described the theft as involving over $6 billion from the exchange.

What addresses did the FBI identify?

The FBI listed over 600 Ethereum addresses, just under 20 Bitcoin addresses, and a single Solana address that currently hold or at some point held funds from the hack.

What is the FBI asking crypto firms to do?

The FBI is asking private sector crypto entities to block transactions with or derived from addresses being used by TraderTraitor actors to launder the stolen assets.

Which services are being urged to respond?

The request includes THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers.

How are the stolen funds being laundered?

Authorities said the hackers had been converting stolen funds mainly into ether and are expected to use swap services and other DeFi tools. Chainalysis also said automated laundering mechanisms are being used to obscure the trail of funds.

How many addresses could become involved?

Chainalysis said the attackers have already used thousands of addresses and expects this to become tens of thousands over the coming weeks as laundering activity expands.