FBI Links 628 Crypto Wallet Addresses to North Korea’s Binance Hack

Listen to this article

Press play to start listening

The FBI has attributed the theft of more than$6 billion from Binance to North Korea, naming the activity it tracks as TraderTraitor and publishing hundreds of cryptocurrency addresses connected to the stolen funds.

In anOctober 31 announcement, the bureau said the theft occurred on or around October 29, 2026. The attribution follows Binance’s disclosure that attackers stole approximately $6.3 billion, with its investigation identifying a compromised DevOps engineer’s laptop and additional breach points.

Investigators from the FBI, US Secret Service and IRS Criminal Investigation have observed the attackers converting stolen assets primarily intoEthereum. They expect further laundering through decentralised finance platforms and instant cryptocurrency swap services.

The agencies are asking cryptocurrency businesses and infrastructure operators to block transactions involving the listed addresses, including transactions carrying funds derived from them. Their appeal specifically includes THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics companies and other virtual asset service providers.

Those requests extend the response from identifying the attackers to restricting where the stolen cryptocurrency can move. Exchanges and other services handling the funds could help interrupt transfers as the attackers attempt to convert or redistribute them.

The FBI announcement follows two days of disclosures about the theft and Binance’s efforts to contain it. Hackread.com’sinitial reportcovered outside estimates of up to $5.8 billion in suspicious transfers, before Binance placed the estimated impact at approximately $6.3 billion.

Binance also reported that around $3 billion had been verified as frozen through cooperation with law enforcement, token issuers and industry partners. Frozen assets cannot be treated as money already recovered by the exchange.

In its first detailed explanation, Binance said a compromised DevOps engineer’s laptop appeared to have allowed an attacker to access a service container and submit unauthorised withdrawal transactions. The exchange said it had found no evidence that wallet private keys had leaked.

Aspreviously reported, Binance subsequently identified additional breach points without explaining them publicly. It promised to cover all losses and said it would release a technical report after completing its investigation.

The FBI’s attribution identifies who it holds responsible, but its announcement does not explain how the engineer’s laptop was compromised or provide a full account of the attack.

The alert lists 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address. According to the FBI, these addresses hold or previously held assets from the theft and are operated by, or closely connected to, North KoreanTraderTraitorhackers.

The complete list is available below, grouped by blockchain and preserving the FBI’s address order and capitalisation.

The bureau is also asking anyone with information about the theft to contact an FBI field office or submit a report through theInternet Crime Complaint Center. Its announcement does not provide a new figure for assets frozen or returned.

Your email address will not be published.Required fields are marked*

Comment*

Name*

Email*

Website

Δ

Email Address*

FIRSTNAME

LASTNAME