The FBI has formally blamed North Korean state-sponsored hackers for the record-breaking Binance cryptocurrency heist and is asking the crypto industry to help stop the stolen funds from being laundered.
The attack was conducted on October 29. Hackers emptied Binance hot wallets on multiple blockchains, moving most of the funds out within roughly 20 minutes. Binance estimates the impact at roughly $6.3 billion, the largest crypto theft on record.
Within hours, blockchain intelligence firms TRM Labs and Chainalysis linked the attack to the North Korean group TraderTraitor. Binance initially said the intrusion may have started with a DevOps engineer’s compromised laptop, and pledged to cover all losses.
The FBI released its attribution on October 31, two days after the theft.
“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages,” the agency said.
The alert names 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address that currently hold, or previously held, proceeds of the theft.
Together with the Secret Service and IRS-CI, the FBI called on THORChain node operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms to refuse transactions linked to these addresses.
The FBI previously blamed the same group for the $1.5 billion Bybit hack in February 2025.
Binance says the attack went beyond one laptop
Binance has since expanded on its early findings. “Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach,” Binance co-CEO Richard Teng said in a statement.
Teng described the incident as a complex attack that “was not carried out by one person.” He said the attacker also deployed a self-destruct mechanism that wiped its tooling and evidence, complicating the investigation.
He said the attacker’s use of Ethereum’s EIP-7702 delegation feature “did not pass through our normal approval controls.” Binance has not yet detailed the additional breach points, and has promised a technical post-mortem once the facts are verified.
Binance began a phased resumption of withdrawals on November 1, starting with the Bitcoin network. By mid-morning on Sunday, it said it had processed about $4.6 billion in withdrawals and $1 billion in deposits.
According to the exchange, about 95% of the stolen amount has now been replaced using company funds, and Binance is buying the remaining less liquid tokens on the market and through over-the-counter deals.
“Our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users,” Teng said.
Laundering appears to be automated
Blockchain analytics firm Elliptic puts the theft at $6.43 billion across 11 blockchains. Of that, it has confirmed $2.85 billion as frozen or seized on-chain.
According to Elliptic’s latest figures, the attacker controls about $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses. These include roughly 584,000 ETH, 18,327 BTC and 233 million XRP.
“In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep,” Elliptic said.
The main wallet distributing funds on Tron kept paying out hourly for more than a day, around the clock. When a cross-chain bridge refused deposits, the system rerouted the money to the same destination through freshly created wallets.
By late October 31, about $196 million had flowed from that wallet to roughly 200 other wallets. THORChain was the largest exit route, at about $31 million.
Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.
Chainalysis also reported laundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.
Related: $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack
Related: Hackers Return $263 Million Stolen From Liquid Network
