The FBI officially attributes the record cryptocurrency theft against the Binance platform to state-sponsored hackers from North Korea. The agency is asking the cryptocurrency industry to help prevent the laundering of the stolen funds.
- The FBI officially attributes the Binance hack to North Korean state-sponsored hackers.
- The theft reached about $6.3 billion, the largest cryptocurrency theft on record.
- Binance says the attack involved several points of compromise and bypassed its usual approval controls.
- The laundering appears automated, and the attacker still controls about $3.25 billion in assets.
The attack occurred on October 29. The hackers drained Binance’s hot wallets, digital wallets connected to the internet, across multiple blockchains, and transferred the bulk of the funds in just under 20 minutes. Binance estimates the impact at around $6.3 billion, which would make it the largest cryptocurrency theft ever recorded.
In the hours that followed, blockchain analytics firms TRM Labs and Chainalysis linked the attack to the North Korean group TraderTraitor. Binance had initially indicated that the intrusion may have started with a compromised DevOps engineer’s laptop and had pledged to cover all losses.
A Formal Attribution by the FBI
The FBI issued its alert on October 31, two days after the theft. “The FBI, with partners from the USSS and IRS-CI, has observed TraderTraitor actors converting the stolen assets primarily into Ethereum (ETH). It is anticipated that these assets will then be laundered by being converted via DeFi services and instant exchanges, in preparation for the next stages of laundering,” the agency states.
The alert lists 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address that currently hold, or have held, the proceeds of the theft. Along with the Secret Service and IRS-CI, the FBI is asking THORChain node operators, RPC node operators, instant exchanges, DeFi services, and blockchain analytics companies to deny transactions linked to these addresses. The agency had previously attributed the $1.5 billion theft suffered by Bybit in February 2025 to the same group.
Binance Describes Broader Attack Than a Single Computer
Binance has since clarified its initial findings. In a statement, co-CEO Richard Teng says: “Our initial investigation suggested the security incident could involve a compromised laptop, but our subsequent investigation revealed additional points of compromise.” He describes a complex attack that “was not carried out by a single individual,” and indicates that the attacker used an Ethereum delegation feature, EIP-7702, which “did not go through our usual approval controls.” Binance has not yet detailed these additional points of compromise and promises a post-mortem technical analysis once the facts are verified. According to Richard Teng, the attacker also deployed a self-destruct mechanism that erased its tools and traces, complicating the investigation. Withdrawals resumed in stages starting November 1, beginning with the Bitcoin network. By mid-morning Sunday, the exchange indicated it had processed approximately $4.6 billion in withdrawals and $1 billion in deposits. It claims to have replaced about 95% of the stolen amount with its own funds and is buying the remaining, less liquid tokens on the market and over-the-counter.
Laundering That Appears Automated
Elliptic estimates the theft at $6.43 billion spread across 11 blockchains, of which $2.85 billion has been frozen or seized on-chain. According to its latest data, the attacker still controls around $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses, including approximately 584,000 ETH, 18,327 BTC, and 233 million XRP. Elliptic notes that the laundering “does not sleep,” unlike the human working patterns observed during the Bybit theft.
The main wallet distributing funds on Tron continued to make payouts every hour for more than a day. When a cross-chain bridge refused deposits, the system redirected the money to the same destination via newly created wallets. By late October, around $196 million had moved from this wallet to about forty… to some 200 other wallets, with THORChain being the main exit route, accounting for about $31 million. Elliptic cannot determine whether the automation relies on AI agents or conventional scripts and expects laundering to be spread over several months, as after the Bybit theft. Chainalysis, for its part, notes laundering patterns indicating automation, including thousands of transactions in a short time and many recent addresses whose first transfer was exactly 1 TRX.
