FBI confirms North Korea's role in $6 billion Binance hack, asks DeFi community to block BTC, ETH, SOL addresses

The FBI has confirmed that North Korea's TraderTraitor hacking group was responsible for last week's theft of more than $6 billion from Binance, the world's largest crypto exchange. CoinDesk reported the confirmation on October 31. The FBI also asked the wider crypto community to block transactions from several hundred addresses that currently hold, or once held, funds from the attack.

According to CoinDesk, Binance was hacked on Thursday and lost about $6.4 billion. Several analytics services and individuals attributed the attack to TraderTraitor. PBS reported that blockchain intelligence firm TRM Labs said an attacker moved roughly $6.36 billion out of Binance wallets across ten blockchains, most of it in about 20 minutes. TRM said several features of the attack matched earlier North Korea-linked heists.

The FBI published its list of addresses on Saturday. Chainalysis CEO Jonathan Levin said the attackers have already used thousands of addresses, so the FBI's list is likely incomplete. Chainalysis expects the number of addresses to keep growing. The FBI's request covers addresses holding Bitcoin, Ether and Solana, and it is aimed at DeFi protocols and other service providers that could freeze or refuse the funds.

Chainalysis published its own analysis attributing the hack to TraderTraitor. Its strongest evidence was that it watched funds stolen from Binance mix on-chain, in real time, with funds taken in last month's Bitget exploit. That earlier theft had already been attributed to North Korean actors. Chainalysis said it is also seeing laundering patterns it has not seen before. It described the Binance incident as the largest hack in crypto history and one of the largest single financial crimes ever.

CNBC reported that crypto firms and law enforcement are in what experts called a cat-and-mouse game to recover the money before the hackers hide it. Chainalysis wrote that the attackers repeatedly circulate funds among addresses, often sending them back to addresses used earlier in the sequence. Levin and TRM Labs' Ari Redbord said that hackers are increasingly using professional money laundering networks, including Chinese ones, to convert crypto to cash. Investigators are therefore often chasing those networks as well as North Korean wallets on-chain.

According to a Reuters-sourced report on Yahoo Finance, the attack resembled the 2025 Bybit heist, which the FBI attributed to North Korea. In both cases the attackers were able to order the exchange's wallets to empty into wallets they controlled. The same report said cryptocurrency prices fell on news of the hack. It also said Binance was conducting a full security review and planned an initial proof-of-reserves snapshot, with results expected by Monday. Binance is working with the FBI and the US Secret Service. The Secret Service said it is working with private-sector partners, including Circle, to identify, freeze, trace and recover the stolen funds. North Korea denies involvement in such attacks, according to that report.

Binance has said it will absorb the losses itself, according to CoinDesk's latest-news coverage. The exchange says it will use corporate funds, futures reserves and its Secure Asset Fund for Users (SAFU), and that user balances remain intact. CoinDesk's listing also says Binance has replaced about 90% of the stolen crypto. CoinDesk separately reported that a Nasdaq-listed company, Next Technology Holding, cited the hack and quantum-computing concerns as it authorized possible sales of, or loans against, its 5,833 BTC.

The FBI's request is an unusual step because it relies on voluntary action by decentralized services. Those services have no central operator who can be ordered to act. Whether it works will depend on how many protocols, exchanges and stablecoin issuers choose to block the listed addresses. It will also depend on how quickly the attackers move funds to new ones. Investigators are still tracing the money, and the figures reported so far may change as the analysis continues.

This is a news summary for general information only — not financial advice, and nothing here is a recommendation to buy, sell, or hold any asset. Always verify against the original source and do your own research before making a financial decision.