On Saturday, October 31, the FBI said that North Korea stands behind the theft of more than $6 billion from the Binance exchange, specifically the hacker group TraderTraitor. The agency also published a list of cryptocurrency addresses and asked industry firms to block transactions with them.
As CoinDesk reports, which covers Saturday’s statement, the FBI concluded that the break-in was carried out by the North Korean group TraderTraitor. It is a sub-unit of the well-known Lazarus group, which has previously been linked to high-profile attacks on cryptocurrency exchanges. Analytics firms and independent industry investigators had already pointed to North Korea, and now the American agency is doing so too. The full text of the FBI statement was quoted, among others, in a post by Changpeng Zhao, the founder of Binance.
In it, CZ thanked the FBI, the Secret Service and the IRS for their help in tracking and freezing the funds. In his view, it is largely thanks to these agencies that the bitcoin market did not react with a sharper decline.
List of addresses and appeal to industry
According to CoinDesk, the FBI listed more than 600 addresses on the Ethereum network, just under 20 bitcoin addresses and one Solana address. The agency says the hackers mainly converted the stolen funds into ether and that it expects further money laundering through exchange services and DeFi tools.
The FBI, the Secret Service (USSS) and IRS-CI have called on operators of THORNode and RPC nodes, instant exchanges, DeFi services, analytics firms and other entities in the cryptocurrency market to block transactions with these addresses or with funds originating from them.
Scale of money laundering
However, the FBI list is only part of the picture. Chainalysis CEO Jonathan Levin said the attackers have already used „thousands of addresses” and that this number could grow to tens of thousands in the coming weeks. He explained that the hackers have too much money for trusted laundering channels, so the funds will flow into a wider network of bridges, instant exchanges and swappers. Chainalysis also describes „novel automated mechanisms” for obscuring the trail.
CoinDesk reports that the theft on Thursday, October 29, amounted to about $6.4 billion, and stablecoin issuers froze over $2.4 billion. These are media figures; the exchange itself had earlier spoken of an estimated impact of $6.3 billion and about $3 billion frozen. We wrote about this in our article on how Binance changed its findings on the attack. We described the beginnings of the case when Binance began investigating a possible attack.
Binance and the political reaction
On Saturday, Binance said it had restored about 90 percent of the stolen assets and announced that withdrawals would resume on Sunday, November 1, provided security checks are completed. The exchange had earlier stated on X that it would cover all customer losses and is cooperating with the authorities.
Asked about the matter on Saturday, President Donald Trump replied that the administration is looking into it and that he „will talk to North Korea”. CoinDesk quotes him.
What it means for users in Poland
For Binance customers, withdrawals are the most important issue: according to the exchange, they are due to resume on Sunday, but its own statement makes this conditional on final confirmation. Balances are to be covered from the exchange’s funds. During such events, the number of fake messages and links grows, so look for information only on Binance’s official channels and never share passwords or codes with anyone. Companies providing crypto services in Poland that serve foreign bridges and swaps may be covered by the FBI’s appeal to block addresses from the list, but this is a request, not a legal obligation in Poland. A similar North Korean trail appeared earlier in the theft from the Bitget exchange.
North Korea had not responded to the accusations at the time of publication.
