FBI Pins $6 Billion Binance Theft on North Korea’s TraderTraitor, Publishes Hacker Wallet List

Introduction

The U.S. Federal Bureau of Investigation, together with the Secret Service and the IRS Criminal Investigation division, has formally linked the massive theft of more than $6 billion from Binance to a North Korean hacking collective known as TraderTraitor. In an alert dated Oct. 31, the agencies published a list of 628 blockchain addresses—spanning Bitcoin, Ethereum, Solana and TRON—to give exchanges, node operators, DeFi platforms and other crypto infrastructure providers a concrete reference for blocking or refusing transactions tied to the stolen funds.

---

What the FBI’s Alert Contains

• Attribution – The agencies state that the hack occurred around Oct. 29 and was carried out by the TraderTraitor group, the same actors previously linked to the $1.5 billion Bybit breach in early 2025.
• Address List – The public list includes 19 Bitcoin addresses, 608 Ethereum addresses, and a single Solana address. These were identified as primary recipients or transit points for the stolen assets.
• Action Requested – Crypto service providers are asked to screen for, and refuse, any transaction that involves the listed wallets or funds that have passed through them. This applies to centralized exchanges, decentralized protocols, instant‑swap services, THORChain nodes, RPC providers, and analytics firms.
• Laundering Pathways – According to the alert, the hackers quickly converted the stolen Binance assets into Ether and began moving funds through DeFi bridges, instant‑swap platforms, and emerging blockchains such as Solana and TRON.

---

How the Industry Reacted

Private‑Sector Forensics

Blockchain analytics firms were already tracking the activity before the FBI’s public statement. TRM Labs first linked the hack to TraderTraitor on Oct. 29, and Chainalysis followed with a detailed timeline on Oct. 30, noting that unauthorized transfers began at roughly 4:20 p.m. ET and that about $2.8 billion had already been frozen by 5:14 p.m. The firms observed automated laundering patterns, including single‑TRX hops before funds were passed onward.

Government‑Industry Coordination

The Secret Service highlighted a rapid response on Nov. 1, stating that investigators worked with industry partners to freeze a “significant portion” of the stolen crypto within minutes of the alert. This mirrors the collaborative approach taken after the Bybit incident, but the FBI’s direct attribution and address list provide a clearer enforcement tool for the broader ecosystem.

---

Practical Steps for Crypto Operators

1. Integrate the Address List – Update AML/KYC screening tools to flag any of the 628 addresses. Most compliance platforms allow bulk import of watchlists.
2. Monitor Transaction Graphs – Use analytics services to trace funds that have interacted with listed wallets, even indirectly, as launderers often employ mixers and multi‑hop transfers.
3. Implement Real‑Time Blocking – For node operators and DeFi protocols, configure RPC endpoints to reject calls that involve the flagged addresses.
4. Report Suspicious Activity – Any attempts to move or convert assets linked to the list should be reported to the FBI’s Internet Crime Complaint Center (IC3) and local field offices.
5. Stay Informed – Follow updates from the FBI, Secret Service, and leading analytics firms, as the list may expand as new laundering pathways are uncovered.

---

Closing Thoughts

The FBI’s decisive move to publish a concrete watchlist underscores a growing willingness of law‑enforcement agencies to engage directly with the decentralized finance ecosystem. While the sheer scale of the Binance theft—over $6 billion—poses a formidable challenge, coordinated action between government bodies and crypto infrastructure providers offers the best chance to stem the flow of illicit funds. Operators who act swiftly to integrate the address list and enhance their monitoring capabilities will not only comply with regulatory expectations but also help protect the broader integrity of the blockchain space.