Mentioned in This Article
1. What did the FBI say about the Binance theft?
On Saturday, October 31, the FBI stated that North Korea's TraderTraitor group carried out the roughly $6.4 billion theft from Binance, and asked crypto companies to block transactions tied to hundreds of addresses that have held the stolen funds. The Secret Service and IRS Criminal Investigation joined the notice. This is the latest North Korea crypto hack to draw a formal federal warning.
The statement matters because it moves the attribution from the private analysts who spoke in the first days after the breach to an official government finding. Several analytics firms and individual researchers had already pointed to TraderTraitor, a group described as a subunit of the broader Lazarus Group. The FBI's notice puts the agency's name behind that conclusion and turns it into a request for concrete action by the industry.
Binance was breached on Thursday, and the exchange lost about $6.4 billion. The bureau's notice came two days later and is aimed at the services that hackers must use to turn stolen assets into money they can spend: swap platforms, bridges, node operators and exchanges.
2. How the FBI expects the funds to be laundered
According to the FBI, the hackers have mainly converted the stolen assets into ether (ETH). Holding the proceeds in the second-largest cryptocurrency gives them a flexible base, because ETH can be swapped for many other tokens and moved across networks through decentralized tools without passing through a single gatekeeper.
The bureau said it expects the attackers to keep laundering the money through swap services and decentralized finance (DeFi) tools. These services let a user exchange one asset for another, or move value from one blockchain to another, often within seconds and without the customer-verification steps that a regulated exchange would require. For a thief holding billions of dollars, that speed and low friction are the main attraction.
Laundering at this scale is difficult in practice. Each venue can absorb only so much volume before prices move, limits are hit or compliance teams notice. That limitation is why the number of addresses involved matters so much, and why the FBI is asking intermediaries to act while the money is still moving instead of after it has been cashed out.
3. Who is being asked to block addresses?
The notice urges private-sector firms to block transactions that involve, or are derived from, the addresses that were used to launder the stolen assets. The FBI named several categories of recipient: THORNode and RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers.
Each of these plays a different role. Node operators relay transactions and could decline to process those connected to listed addresses. Instant exchanges and swap services can refuse to take deposits from them. Analytics firms can tag the addresses so that their clients' compliance tools raise alerts, and other virtual asset service providers, a legal term covering exchanges, custodians and similar businesses, can freeze or reject incoming funds.
The request is voluntary in the sense that it is a law enforcement advisory and not a court order. Even so, such notices carry weight because financial firms that knowingly handle the proceeds of a sanctioned hacking group face legal and reputational exposure. For decentralized protocols without a central operator, the request is harder to carry out, because no single party controls who can use the software.
4. What addresses did the FBI publish?
The list contains more than 600 Ethereum addresses, just under 20 Bitcoin (BTC) addresses and one Solana (SOL) address. The heavy weighting toward Ethereum is consistent with the bureau's statement that the hackers have mostly converted the loot into ETH.
A published address list gives compliance staff something specific to screen against. A firm can check whether an incoming deposit comes from one of the named addresses, or whether it was sent onward by one, which is what the phrase derived from addresses in the notice refers to. Tracing that second step is where blockchain analytics providers add the most value, since stolen funds are rarely moved in a single hop.
A fixed list also has an obvious weakness. It captures addresses that are known at the time it is compiled, and the attackers can create new ones faster than any agency can publish them. The scale of the problem was underlined by an industry estimate released the same weekend.
5. Why does Chainalysis say the FBI list is only a start?
Chainalysis, the blockchain analytics firm, says the attackers have already used thousands of addresses, far more than the several hundred the FBI listed. Chief Executive Jonathan Levin said he expects that number to keep growing and to reach the tens of thousands in the coming weeks.
Levin's explanation is a matter of capacity. In his account, the attackers hold more money than the laundering venues they trust can handle, so the funds are spilling into other channels, including bridges, instant exchanges and swap services. Spreading value across many addresses and many venues is a standard way to avoid hitting the limits and alarms of any one of them.
Levin also said the group is using novel automated laundering mechanisms. A Chainalysis blog post published on Friday made a similar point, saying that the volume of transactions suggests automated tools are shifting money between addresses before sending it onward, with the aim of obscuring the trail of funds. Automation lets a small team operate thousands of wallets at once, which is far beyond what manual transfers could achieve.
6. How much of the stolen money has been recovered or frozen?
Stablecoin issuers have frozen more than $2.4 billion of the stolen funds, which is the largest verified block of recovered or immobilized value so far. Stablecoins are tokens pegged to a currency such as the dollar, and their issuers retain the technical ability to blacklist specific addresses, which makes them one of the few points of control in an otherwise permissionless system.
The attackers are still moving much of the remainder. That leaves a gap between the amount frozen and the total stolen, and the FBI's call to block addresses is meant to narrow it by closing off the routes that remain open.
Separately, Binance said earlier on Saturday that it had replaced 90% of the stolen crypto. This is a statement about the exchange's own balance sheet, not about recovering the original coins from the thieves. In practical terms, it means the company has restored most of the customer-facing assets from its own resources so that it can resume normal service, while the stolen funds themselves remain largely at large.
The exchange also said it planned to resume customer withdrawals on Sunday. For account holders, that date is the most immediate practical milestone arising from the incident.
7. Why TraderTraitor and the Lazarus Group matter
TraderTraitor is described as a subunit of the Lazarus Group, the North Korean hacking collective that has carried out several major exchange hacks. Naming the group is significant because North Korean operators are not ordinary criminals seeking a quick payout. Their thefts are widely understood to be a source of revenue for a state under international sanctions.
That context shapes how the response works. Funds taken by a state-linked group are treated by regulators and law enforcement as potentially linked to sanctions evasion, which raises the stakes for any company that handles them, knowingly or not. It also explains why the notice is addressed so broadly, to analytics firms and infrastructure operators and not only to exchanges.
The attribution also reflects the fact that the bureau and its partners are working alongside private investigators. Analytics firms follow the funds on public blockchains, while agencies bring intelligence and legal authority that private companies lack. The combination is now a familiar pattern after large crypto thefts: private tracing first, government confirmation next, and a joint effort to choke off the exit routes.
8. What has the White House said?
President Donald Trump was asked about the hack on Saturday by a reporter at the White House. He said that the administration is learning about it and added that it would talk to North Korea about the matter.
The remark was brief, and no further detail on any planned diplomatic contact was given. It does show that the breach has reached the highest level of the US government, a notable step for what began as a corporate security incident at a single exchange.
Whether any such conversation could lead to the return of funds is unclear. Past cases involving state-linked hackers have rarely produced recoveries through diplomacy, and the practical levers have instead been sanctions, indictments and the blocking of laundering channels. That is the approach the FBI notice follows.
9. What happens next?
The nearest milestone is Binance's plan to reopen customer withdrawals on Sunday, which will show whether the exchange's replacement of 90% of the stolen assets is enough to restore normal operations. Users will also watch whether the exchange gives further detail on how the breach occurred.
On the investigative side, the central question is whether the industry responds to the FBI's request quickly enough to matter. Chainalysis expects the number of addresses used by the attackers to climb into the tens of thousands in the coming weeks, so any blocking effort that relies on a static list will need frequent updates and close coordination between agencies, analytics providers and the services that handle swaps and bridging.
Another thing to watch is the size of the frozen total. Stablecoin issuers have immobilized more than $2.4 billion, and further freezes would reduce what the attackers can ultimately cash out. Because the attackers are still moving funds, the figures are likely to keep changing as the investigation continues.