The FBI has officially blamed North Korean state-sponsored hackers for the record Binance cryptocurrency heist and is calling on the crypto industry to help prevent stolen funds from being laundered.
The attack took place on October 29. Hackers dumped Binance hot wallets across multiple blockchains, moving most of the funds in about 20 minutes. Binance estimates the impact at around $6.3 billion, the largest crypto theft on record.
Within hours, blockchain intelligence firms TRM Labs and Chainalysis linked the attack to the North Korean group TraderTraitor. Binance initially said the intrusion may have started with a DevOps engineer’s compromised laptop and vowed to cover any losses.
The FBI released its attribution on October 31, two days after the theft.
“The FBI, working with partners at the USSS and IRS-CI, observed TraderTraitor actors convert the stolen assets primarily into Ethereum (ETH). It is expected that these assets will then be further laundered by converting them using DeFi and instant exchange services as they prepare them for further stages of laundering,” the agency said.
The alert names 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address that currently hold or previously held the proceeds of the theft.
Working with the Secret Service and IRS-CI, the FBI has called on THORChain node operators, RPC node operators, instant exchanges, DeFi services, and blockchain analytics companies to refuse transactions linked to these addresses.
The FBI previously blamed the same group for the $1.5 billion Bybit hack in February 2025.
Binance says attack spread beyond a single laptop
Binance has since developed its initial findings. “Our initial investigation suggested that the security incident may have involved a compromised laptop, but our subsequent investigation revealed additional points of violation,” Binance co-CEO Richard Teng said in a statement. statement.
Teng described the incident as a complex attack that “was not carried out by a single person.” He added that the attacker also deployed a self-destruct mechanism that erased his tools and evidence, complicating the investigation.
It said the attacker’s use of Ethereum’s EIP-7702 delegation function “did not pass through our normal approval checks.” Binance has not yet detailed additional points of violation and has promised a technical post-mortem once the facts are verified.
Binance began a gradual resumption of withdrawals on November 1, starting with the Bitcoin network. As of mid-morning Sunday, it said it had processed about $4.6 billion in withdrawals and $1 billion in deposits.
According to the exchange, around 95% of the stolen amount has now been replaced using company funds, and Binance is purchasing the remaining, less liquid tokens on the market and through over-the-counter agreements.
“Our commitment remains clear: Binance will absorb the financial impact of stolen funds, not our users,” Teng said.
Laundering appears to be automated
Blockchain analysis company Elliptic estimates the theft at $6.43 billion on 11 blockchains. Of this amount, he confirmed that $2.85 billion was frozen or seized on-chain.
According to Elliptic latest figuresthe attacker controls approximately $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses. These include approximately 584,000 ETH, 18,327 BTC, and 233 million XRP.
“In the Bybit hack, laundering followed human working patterns. Binance funds are being moved by something that doesn’t sleep,” Elliptic said.
The main wallet distributing funds on Tron continued to pay out hourly for over a day, 24 hours a day. When a cross-chain bridge refused deposits, the system redirected the money to the same destination via freshly created wallets.
As of the end of October 31, approximately $196 million had been transferred from this wallet to approximately 200 other wallets. THORChain was the largest exit route, with around $31 million.
Elliptic said on-chain data cannot show whether automation relies on AI agents or conventional scripts. He expects the laundering to take months, as was the case after the Bybit heist.
Chainalysis also reported whitening models indicating automationincluding thousands of transactions in a short period of time and many new addresses whose first transfer was exactly 1 TRX.
Related: More than $2 million drained from Polymarket merchants in new supply chain attack
Related: Hackers return $263 million stolen from Liquid Network
