FBI Confirms North Korean Hackers Behind Binance Theft, Calls on Industry to Block Related Addresses

This morning, a notice issued by the U.S. Federal Bureau of Investigation (FBI) stated that North Korea is responsible for the theft of more than $6 billion in virtual assets from Binance, and referred to the related malicious cyber activity as "TraderTraitor." The FBI also previously identified this group as the attackers behind last year's roughly $1.5 billion Bybit theft.

Just yesterday, when Trump was asked whether the attack was carried out by North Korea, he said, "We don't know, it's under investigation." Now that the FBI has formally announced the attribution, the investigation into the largest theft in the crypto industry has reached a new stage.

FBI Publishes the Addresses Involved, Calls on the Industry to Help Block the Funds

Along with identifying the attackers, the FBI also disclosed the movement of the stolen funds. The FBI said it, together with the U.S. Secret Service (USSS) and Internal Revenue Service Criminal Investigation (IRS-CI), has observed that the attackers are mainly converting the stolen assets into ETH, and expects they will continue to launder money through DeFi and instant exchange services to prepare for further transfers of funds.

To stop the illicit proceeds from continuing to circulate, the FBI published the relevant addresses (link to the relevant addresses: https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack), and calls on THORChain node operators, RPC node operators, instant exchange platforms, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions related to these addresses and to funds derived from them. Even if the funds have already been moved into new wallets, as long as they can be traced back to the addresses involved, they fall within the scope the FBI is calling to be blocked. The FBI also invited individuals or institutions with information to provide it to their local FBI office or to the Internet Crime Complaint Center (IC3).

While law enforcement seeks industry assistance, the attackers are still accelerating the movement of the stolen funds. On-chain monitoring shows that some funds are cycling repeatedly among multiple old and new wallets and are successively entering exchange and cross-chain services.

Funds Moved for 31 Consecutive Hours; Hackers Suspected of Starting Automated Money Laundering

Yesterday, the hackers continued to split, cycle back and redistribute the stolen funds among multiple wallets. According to monitoring by Onchain Lens, the attackers moved 120 million TRX, worth about $38.78 million at the price at the time of monitoring, and then further dispersed it to multiple destination addresses. After passing through several wallets, some of the funds returned to addresses used earlier before being sent on to new wallets, making the trail more difficult to follow.

Elliptic's monitoring update yesterday showed that the main distribution wallet on the Tron network had sent out about $93.5 million to roughly 150 wallets while continuing to receive large top-ups. Overnight, the transfer speed increased further, reaching about $3 million to $7 million per hour.

These transfers show clear signs of automation. The main distribution wallet sent funds out every hour for 31 consecutive hours, with the longest pause only 46 minutes; receiving wallets usually forwarded the funds within about two minutes. On that basis, Elliptic judged that the operations were very likely software-driven and kept running overnight.

The dispersed funds are flowing into exchange and cross-chain services. As of 16:11 yesterday, Elliptic had traced about $25 million flowing into THORChain, with another roughly $5.3 million and $1.8 million going to SunSwap and Bitget Swap respectively. The movement of funds has extended from repeated wallet-to-wallet transfers to various exchange and cross-chain channels.

90% of Assets Backfilled; Binance Allocates Half of the SAFU Funds

While the hackers keep moving the stolen funds, Binance is also buying tokens to make up the asset shortfall. According to the latest official announcement, about 90% of the affected assets have been backfilled, up from the roughly 80% previously disclosed. BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC have been restored to full reserve backing, while the remaining roughly 10% mainly involves lower-liquidity tokens that still need to be purchased through market and over-the-counter channels.

The backfill funding comes from the company's own capital, part of the SAFU fund and part of the futures insurance fund. This morning, Binance co-CEO Yi He further said that 50% of the funds in the SAFU fund address will be allocated to cover this loss, with the other half retained. On-chain information shows that the address has sent out a total of 7,500 BTC in three transactions, leaving 7,500 BTC, worth about $580 million at the price at the time of reporting.

As the backfill progresses, what users will be watching next is whether the reserves can be verified and when withdrawals will resume. Binance said the proof-of-reserves snapshot as of 8:00 a.m. Beijing time on October 31 has been completed, and the full zero-knowledge proof is expected to be generated on November 3. In addition, withdrawal services still target a resumption today, with the specific arrangements to be announced further.

The FBI's attribution provides a direction for accountability, but the stolen funds are still moving, and recovering the assets will take time. For Binance, the coming test is to complete the remaining backfill, restore withdrawals and publish a full security review. Replenishing the assets is only the first step; letting users deposit and withdraw with confidence is the real focus in the aftermath of this crisis.

Join the official Coincamps community:

X: https://x.com/coincamps

Telegram: https://t.me/coin_camps