TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The FBI said North Korea’s TraderTraitor group was behind the theft of about $6.4 billion from Binance and published hundreds of cryptocurrency addresses tied to the stolen funds. It urged crypto services and infrastructure operators to block transactions involving those addresses as laundering continued. The scope of the recovery and the attackers’ next steps remain unclear.
The FBI said North Korea’s TraderTraitor hacking group was behind last week’s theft of about $6.4 billion from Binance and asked cryptocurrency services to block transactions tied to hundreds of addresses associated with the stolen funds. The request names operators across decentralized finance and crypto infrastructure as investigators say the attackers are laundering assets across multiple networks.
In a statement issued Saturday, the FBI identified more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address that it said currently hold, or previously held, funds connected to the hack. The agency said the stolen assets had been converted mainly into ether and warned that the attackers could use swap services and other DeFi tools to move the funds. The list identifies addresses; it does not, by itself, establish who controls every address or show that all funds remain there.
The FBI said it was acting with the U.S. Secret Service and the IRS Criminal Investigation division in asking private-sector entities to block transactions with, or derived from, addresses used by TraderTraitor actors. The requested recipients include THORNode and RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset providers. The statement is a request to industry participants; the source material does not describe it as a court order.
Binance was hacked on Thursday, according to the report, with the loss estimated at about $6.4 billion. Stablecoin issuers had frozen more than $2.4 billion of the stolen funds, while the attackers continued laundering other assets. Binance said Saturday it had replenished 90% of the stolen cryptocurrencies and planned to resume customer withdrawals Sunday. Those figures and plans were reported as statements by the company and do not establish the amount ultimately recovered or the status of withdrawals after the announcement.
Blocking Routes Used to Launder Funds
The FBI’s notice turns the attribution into a request for action by a broad set of companies and infrastructure operators. If services screen and block the listed addresses, they may make it harder to move funds through some routes. The request also highlights the limits of a static address list: investigators and service providers may need to track funds as they pass through new wallets, swaps and cross-chain services.
The scale of the theft makes the response relevant beyond Binance. Billions of dollars in stolen assets can put pressure on exchanges, stablecoin issuers and DeFi platforms to identify suspicious activity while operating across different systems and jurisdictions. The FBI’s request does not confirm that every service will comply or that blocking transactions will recover the assets.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Ledger Flex Crypto Wallet
As an affiliate, we earn on qualifying purchases.
How the Stolen Funds Are Moving
The FBI identified the suspected group as TraderTraitor, which the report describes as a subunit of North Korea’s Lazarus Group. The agency’s statement follows the Thursday breach of Binance, which the report says cost the exchange approximately $6.4 billion. Earlier attribution by analytics services and individuals preceded the FBI’s public statement; the FBI’s announcement is the government agency’s stated conclusion, not a criminal conviction.
Blockchain analytics firm Chainalysis said attackers had already used thousands of addresses and expected that number to rise. Its CEO, Jonathan Levin, said the laundering network could expand to include bridges, instant exchanges and swap services because the volume of funds may exceed the capacity of the attackers’ usual laundering channels. Chainalysis also said transaction patterns suggested automated tools were circulating funds among addresses to obscure their trail. These are the firm’s assessments, not details independently established in the FBI statement.
The report said stablecoin issuers had frozen more than $2.4 billion of the stolen assets by the time of publication. That action differs from blocking activity on decentralized services: freezes by issuers do not automatically prevent funds on other networks or through other providers from moving.
Recovery and Address Coverage Remain Unclear
The report does not establish how much of the stolen cryptocurrency had been recovered, frozen or moved beyond reach by the time of the FBI notice. Binance’s statement that it had replenished 90% of the stolen cryptocurrencies is not the same as confirmation that 90% of the stolen assets were recovered. The eventual status of customer withdrawals also is not confirmed in the source material.
It is not clear how many services will follow the FBI’s request, how quickly they can identify transactions derived from the listed addresses, or whether the attackers will shift to wallets and services not included in the notice. Chainalysis’s forecast of tens of thousands of addresses is an estimate, and the FBI’s attribution does not resolve questions about individual suspects, the precise method of the breach or whether further actions will be announced.
Monitoring New Wallets and Service Responses
Crypto businesses and infrastructure operators will be asked to assess the FBI’s address list and determine whether transactions on their services involve the identified wallets or funds derived from them. Because Chainalysis expects the laundering network to widen, investigators and analytics firms may continue tracking new addresses and routes. Any additional freezes, enforcement measures or updates from the FBI, Binance and service providers could clarify how much money can be contained.
The immediate milestones are whether Binance resumed withdrawals as planned and whether the FBI or its partner agencies publish further guidance. The source material does not give a timetable for additional notices or say what action the agencies might take if the funds move through new services.
Key Questions
Who does the FBI say was behind the Binance hack?
The FBI attributed the breach to TraderTraitor, a North Korean hacking group that the report describes as a subunit of the Lazarus Group. This is the agency’s attribution; the report does not describe a criminal conviction.
How much was stolen from Binance?
The report puts the loss at about $6.4 billion. Binance said it had replenished 90% of the stolen cryptocurrencies, but that statement does not establish how much of the stolen assets were recovered.
Which addresses did the FBI identify?
The FBI listed more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address connected to funds from the hack. It said the addresses currently hold, or at some point held, related funds.
What is the FBI asking crypto companies to do?
The FBI, Secret Service and IRS Criminal Investigation asked private-sector crypto services and infrastructure operators to block transactions with, or derived from, the listed addresses. The statement describes an agency request, not a court order.
Has the stolen cryptocurrency been recovered?
The report says stablecoin issuers froze more than $2.4 billion of the funds, but does not state the final amount recovered. Binance’s reported replenishment of 90% of stolen cryptocurrencies is a separate company statement and is not confirmation that those assets were recovered from the attackers.
Source: coindesk.com
