FBI ties $6bn Binance theft to North Korea’s TraderTraitor

The FBI attributed the theft of more than $6 billion from Binance on or about October 29 to North Korea’s TraderTraitor group, in an alert published October 31. The attribution puts the largest reported crypto theft on record in the context of a laundering operation that investigators say is still unfolding. The bureau said it had observed the group converting stolen assets primarily into ether and expected further laundering through DeFi and instant swap services. Its public alert on the Binance attack listed blockchain addresses that firms were asked to block.

The FBI’s notice names TraderTraitor, which it identifies as North Korean malicious cyber activity, and says the theft took place on or about October 29. The Associated Press reported that Binance said more than $6 billion was stolen and described it as the largest cryptocurrency heist on record. The bureau’s alert focuses on attribution and the movement of funds; it does not describe how the attackers first gained access.

How did the attackers move funds out of Binance?

Blockchain analytics firm Chainalysis says funds began leaving Binance hot wallets across multiple blockchains at about 4:20 p.m. Eastern Time on October 29. Its analysis of the Binance hack estimates unauthorized transfers at approximately $6.4 billion. On Ethereum, Chainalysis says an operational wallet funded through Tornado Cash submitted signed authorizations that let a Binance hot wallet run attacker-deployed code and sweep assets to attacker-controlled addresses.

Chainalysis says other affected Binance wallets appeared to send assets through ordinary signed transfers. The distinction matters: the published analysis describes more than one transfer path, but does not establish a single mechanism across every affected blockchain or wallet. The company attributes the attack to TraderTraitor, citing on-chain patterns and funds from the Binance theft commingling with funds from a separate Bitget theft it says was attributed to North Korean actors.

How much has been frozen, and what happens next?

Chainalysis reported that freezes began at 5:14 p.m. Eastern on October 29 and that about $2.8 billion had been frozen as of 11:30 a.m. Eastern on November 3. The firm says the attacker tried to move stablecoins into assets that issuers cannot freeze, including by swapping $325 million in stablecoins for $285 million in ether over nearly 20 minutes. Those figures come from Chainalysis’s tracking, while the FBI’s alert separately describes the stolen assets as being converted primarily into ether.

The FBI urged exchange, DeFi, instant exchange and infrastructure operators to block transactions linked to the addresses in its alert. Chainalysis says its investigation is ongoing and that the funds may continue moving. The public material reviewed here does not establish how much of the stolen value will ultimately be recovered or identify the initial point of compromise.

References

• public alert on the Binance attack — fbi.gov
• analysis of the Binance hack — chainalysis.com