The FBI has formally attributed the $6.3 billion Binance hack to North Korea’s TraderTraitor operation, identifying hundreds of cryptocurrency addresses linked to the theft and urging exchang
The FBI has formally attributed the $6.3 billion Binance hack to North Korea’s TraderTraitor operation, identifying hundreds of cryptocurrency addresses linked to the theft and urging exchanges, decentralized finance protocols and blockchain infrastructure providers to block transactions involving stolen funds.
The October 31 confirmation follows Binance’s record-breaking security breach two days earlier, when attackers compromised the exchange’s hot wallets and transferred billions of dollars across multiple blockchains. Approximately $3 billion in affected assets has been frozen through coordination with stablecoin issuers and blockchain partners.
Binance has since replenished approximately 95% of the impacted assets using corporate reserves and emergency funds, while preparing to resume customer withdrawals on November 1.
The FBI attributed the October 29 theft to TraderTraitor, a North Korean hacking operation previously linked to major cryptocurrency thefts.
Working alongside the U.S. Secret Service and IRS Criminal Investigation, federal investigators identified stolen assets being converted primarily into Ethereum, with further laundering expected through decentralized exchanges, instant-swap services and other DeFi infrastructure.
The agencies called on trading platforms, THORNode operators, RPC providers and blockchain analytics companies to block transactions involving identified attacker-controlled addresses.
The FBI also published an extensive list of cryptocurrency addresses associated with the operation, including hundreds on Ethereum and additional addresses on Bitcoin and Solana.
The attribution reinforces earlier findings by blockchain intelligence firms TRM Labs and Chainalysis, which identified transaction patterns consistent with North Korean operations.
TraderTraitor was also implicated in the February 2025 Bybit attack that resulted in approximately $1.5 billion in losses. The Binance breach is more than four times larger, making it the biggest cryptocurrency theft on record based on current estimates.
President Donald Trump responded cautiously when questioned about the North Korean connection on October 31, saying his administration was still assessing the situation.
“We don’t know if it’s North Korea, but if it is, we’ll talk to North Korea about it,” Trump said during remarks at Mar-a-Lago.
Binance has accelerated efforts to restore affected reserves, increasing its replacement coverage from 80% on October 30 to 90% the following day and approximately 95% by November 1.
The exchange confirmed that ten major assets are fully backed, including BTC, ETH, USDT, USDC, BNB, SOL, XRP, USD1, RLUSD and ZEC. The outstanding 5% consists primarily of less liquid tokens that Binance continues acquiring through market purchases and over-the-counter transactions.
The replenishment draws on Binance’s Secure Asset Fund for Users (SAFU), its futures insurance fund and corporate treasury. Replacing affected reserves is separate from recovering stolen cryptocurrency, with the approximately $3 billion frozen on-chain not necessarily returned to the exchange.
Withdrawals are scheduled to resume progressively between 06:00 and 09:00 UTC on November 1, beginning with major networks including Bitcoin, Ethereum, BNB Chain, Solana, Tron and XRP Ledger.
Deposits have remained operational throughout the recovery process.
Binance’s initial investigation identified a potentially compromised DevOps employee laptop and unauthorized access to internal withdrawal infrastructure, although subsequent findings revealed additional points of compromise. The exchange has found no evidence that wallet private keys were leaked.
A complete technical explanation remains pending, while the FBI’s attribution shifts attention toward tracing and disrupting the movement of stolen funds.
Despite Binance’s commitment to absorb customer losses, the scale of the attack underscores the continuing threat posed by state-sponsored hacking operations targeting cryptocurrency infrastructure.
The post FBI Links $6.3B Binance Hack to North Korea’s TraderTraitor appeared first on Crypto Adventure.
