FBI ties $6bn Binance theft to North Korea’s TraderTraitor

The FBI said on Oct. 31 that North Korea’s TraderTraitor group was responsible for stealing more than $6 billion in virtual assets from Binance on or about Oct. 29. The attribution puts a state-linked threat group behind a record-scale exchange theft and gives crypto services addresses to screen as the stolen funds move.

The bureau’s announcement names TraderTraitor as the actor and says investigators with the U.S. Secret Service and IRS Criminal Investigation observed the group converting the stolen assets primarily into Ether (ETH). The FBI urged exchanges, DeFi services, node operators and other virtual-asset businesses to block transactions linked to addresses it published.

How much was taken, and where did the funds go?

Binance reported a $6.3 billion impact, according to the Associated Press, while the FBI’s statement gives a lower bound of more than $6 billion. Blockchain analytics firm Elliptic counted $6.43 billion in cryptoassets stolen, based on its own analysis. The figures are not identical because they come from different estimates; the FBI’s announcement does not provide a precise total.

Elliptic says the attacker drained Binance hot wallets across 11 blockchains over several hours. Its analysis found that four assets accounted for 74% of the theft: USDT on Ethereum, bitcoin, USDC and USDT on Tron. About two-thirds of the Ethereum losses—$2.53 billion—left in one transaction at 20:24 UTC, according to Elliptic. The firm excluded another $169 million that moved after Binance suspended withdrawals, saying those funds went to established addresses and appeared to be Binance’s own transfers.

What laundering route does the FBI expect?

The FBI says it has observed the attackers converting the stolen assets mainly into ETH, and expects further laundering through DeFi protocols and instant-swap services. Those routes can move assets between tokens or services, so the bureau’s request is aimed at intermediaries that may be able to identify and block transfers connected to the listed addresses.

Elliptic’s analysis of the theft also describes activity across chains and a continuing effort to move funds. The analytics firm said it had verified $2.85 billion in frozen or seized funds at the time of its report, nearly all in USDT and USDC. That figure is Elliptic’s snapshot, not a total supplied by the FBI, and the amount recoverable can change as assets move or are frozen.

What does the attribution mean for Binance customers?

The FBI’s announcement identifies the suspected operator and provides addresses for the industry to monitor; it does not describe how the attackers gained access to Binance or name an individual suspect. Elliptic says Binance initially linked the breach to a compromised DevOps engineer’s laptop, then disclosed additional points of breach. The firm also says the attackers drained hot wallets, but its account does not establish that every stolen asset was held in the same type of wallet.

The Associated Press reported that Binance said it had enough of the same digital assets set aside to cover 90% of the missing funds and promised customers full reimbursement. That is the exchange’s stated response; it does not change the FBI’s request to block linked transactions. For you as a customer, the key distinction is between the exchange’s commitment to cover losses and the separate on-chain effort to trace, freeze or recover the stolen assets.

Sources and documents

• announcement — fbi.gov
• analysis of the theft — elliptic.co