The FBI has attributed the theft of more than $6 billion in virtual assets from Binance to North Korea, naming the state-backed operation TraderTraitor. The agency said the attack occurred on or about Oct. 29, making it one of the largest cryptocurrency thefts publicly disclosed and adding a formal government attribution to earlier assessments by blockchain-intelligence firms.
The FBI’s associated address list contains 628 wallets: 608 on Ethereum, 19 on Bitcoin and one on Solana, according to SecurityWeek’s review of the alert. The addresses include wallets that currently hold, or previously held, assets tied to the theft. The FBI is urging exchanges, virtual-asset service providers and other organizations to block transactions connected with the listed addresses.
According to the FBI, investigators working with the U.S. Secret Service and IRS Criminal Investigation observed the operators converting the stolen assets primarily into Ether. The agency expects the funds to move through decentralized-finance protocols and instant-swap services as the attackers attempt to obscure their origin and prepare the proceeds for additional laundering.
The attribution matters because TraderTraitor is the label the FBI uses for a North Korean malicious cyber-activity set associated with major cryptocurrency thefts. Private-sector investigators had also linked the Binance incident to North Korea, but the FBI’s statement provides the clearest official warning yet for companies handling the stolen funds. The agency did not identify a software vulnerability or publish a CVE associated with the incident, so there is no conventional vendor patch for defenders to deploy.
For exchanges and custodians, the immediate priority is transaction screening against all 628 addresses, including historical exposure rather than only current balances. Security teams should preserve wallet, withdrawal and authentication logs, apply heightened review to rapid asset conversions and cross-chain swaps, and coordinate suspected matches with law enforcement and blockchain-analytics providers. The FBI’s warning indicates that tracing and interrupting movement of the assets—not patching a vulnerable product—is the central defensive task.
