The U.S. Federal Bureau of Investigation (FBI) confirmed that North Korea was behind the cyberattack on the world’s largest cryptocurrency exchange, Binance, on Thursday, Oct. 29, which caused losses exceeding $6 billion.
According to the FBI’s statement on Saturday, Oct. 31, the attack was carried out by TraderTraitor hackers, known as a subgroup linked to North Korea’s Lazarus Group. The U.S. Secret Service (USSS) and the Internal Revenue Service’s Criminal Investigation unit (IRS-CI) also joined the statement.
Hundreds of addresses released
The FBI publicly released more than 600 Ethereum addresses, nearly 20 Bitcoin addresses and one Solana address used by the hackers to launder the stolen assets. The agency urged exchanges, decentralized finance (DeFi) services, node operators and blockchain analytics firms to block these addresses and transactions originating from them.
According to the FBI, the attackers converted most of the stolen funds into Ether and are expected to continue using swap services and DeFi tools in the laundering process. Jonathan Levin, CEO of blockchain analytics firm Chainalysis, said the attackers had already used thousands of addresses and that the number could reach tens of thousands in the coming weeks.
Binance covers the losses
Binance announced that it had replaced 90 percent of the stolen crypto assets from its own resources and would gradually reopen customer withdrawals, starting with Bitcoin. Stablecoin issuers also froze more than $2.4 billion of the stolen funds.
U.S. President Donald Trump responded to a question about the issue at the White House, saying, “We’re learning about it,” and added that his administration would discuss the matter with North Korea.
TraderTraitor had also been held responsible for the February 2025 attack in which approximately $1.5 billion in cryptocurrency was stolen from the Bybit exchange. The Binance attack went down as the largest theft in cryptocurrency history.