The FBI has identified North Korea's TraderTraitor hacking group as responsible for the theft of more than USD 6 billion in cryptocurrency from Binance. The agency has asked crypto exchanges, decentralized finance (DeFi) services, and blockchain operators to block transactions connected to wallets used to move the stolen assets.
According to the FBI's October 31 notice, investigators have tracked stolen funds across several blockchains since the October 29 attack. The warning comes as Binance works to replace stolen assets and restore withdrawals.
The FBI said it worked with the U.S. Secret Service and the Internal Revenue Service's Criminal Investigation division to trace the funds. Investigators observed the attackers converting stolen assets mainly into Ethereum. The agencies expect further transfers through DeFi platforms and services that exchange one cryptocurrency for another.
The published notice lists more than 600 Ethereum addresses, 19 Bitcoin addresses, and one Solana address. According to the FBI, the listed wallets either held stolen funds or have connections to those moving them. Some addresses may no longer hold the assets, as investigators also included wallets used earlier in the transfer process.
Federal authorities asked THORNode operators, blockchain network providers, instant exchanges, and DeFi services to block related transactions. Their request also covers transactions derived from the identified addresses, rather than only direct transfers. The FBI invited anyone with information about the theft to contact its field offices or Internet Crime Complaint Center.
Chainalysis CEO Jonathan Levin said the attackers had already used "thousands of addresses" to transfer funds after the Binance breach. He expects the figure to reach "tens of thousands" over the coming weeks. That estimate reflects the firm's outlook as investigators continue following the money.
Levin said the attackers may move funds through a wider range of bridges, instant exchanges, and cryptocurrency swap services. He linked this expected expansion to the amount stolen, which could exceed the capacity of their usual laundering channels. These transactions may spread the funds across more wallets and service providers.
In its October 30 analysis, Chainalysis described unusual patterns involving repeated transfers between addresses. The firm said the volume and timing of transactions suggested the attackers were using automated systems to make funds harder to trace. Some transfers returned assets to wallets previously used in the same chain of movements.
Meanwhile, Binance reported on November 1 that it had replaced about 95% of the assets affected by the attack. That figure rose from 90% in its October 31 update. The remaining 5% includes less liquid tokens that the exchange said would take longer to buy.
Binance said it had allocated more than USD 6.34 billion to cover losses using company resources. The exchange also drew on its Secure Asset Fund for Users and Futures Insurance Fund. It reported that balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC were fully backed.
The exchange announced a phased return of withdrawals on November 1, starting with major networks including Bitcoin, Ethereum, and Solana. It said deposits remained available throughout the suspension. Binance maintained that customers would not bear the cost of the stolen assets while investigators continued tracing the funds.
ALSO READ: Bitcoin and Ethereum Price Outlook: Can BTC Hold USD 76K as ETF Outflows Rise?