FBI Blames North Korea for $6.3B Binance Hack, Urges Crypto Firms to Block Funds

The FBI has publicly attributed the theft of more than $6 billion in cryptocurrency from Binance to North Korea, moving the case beyond the earlier assessments of private blockchain investigators. In a 31 October alert, the bureau identified the attackers as TraderTraitor and urged exchanges and other crypto services to block transactions connected to a list of addresses associated with the stolen funds.

The announcement is a significant development in the investigation into the 29 October breach. TechBooky previously reported that TRM Labs had linked the attack to TraderTraitor, while making clear that a researcher attribution was not yet a government finding. The FBI has now made that attribution itself. It has not, however, published a complete account of how the attackers gained access to Binance’s systems.

The bureau said it and partners at the US Secret Service and IRS Criminal Investigation had observed the attackers converting stolen assets primarily into Ether. Investigators expect further movements through decentralised finance and instant-swap services as the group attempts to launder the proceeds. That is why the alert is directed not only at Binance but also at the infrastructure through which funds can move after a theft.

The agencies asked virtual-asset providers, decentralised finance services, blockchain analytics companies, instant exchanges and relevant network operators to block transactions with or derived from the addresses in the FBI notice. Publishing addresses gives those organisations actionable indicators they can add to screening systems. It does not by itself freeze every asset, undo completed transfers or guarantee that all stolen funds can be recovered.

The FBI’s attribution is an investigative conclusion, not a public explanation of every step in the intrusion. Binance has said it is working with law enforcement and industry partners while it continues its own investigation. Its eventual post-incident report will matter for understanding whether the breach involved a compromised device, access controls, wallet-signing processes or several failures together.

Binance says it will absorb the financial impact on users. In its 1 November recovery update, the exchange said it had replenished about 95% of the affected amount using company resources and was preparing to resume withdrawals in phases. That figure describes replacement of assets backing customer balances, not recovery of 95% of the original stolen cryptocurrency from the attackers.

The distinction matters for the industry. Customers need access to their balances and credible proof that they are covered. Investigators, meanwhile, need to trace the stolen funds across chains and prevent them from being laundered. The two efforts can progress at different speeds. A restored balance is valuable to a customer even if the stolen coins remain outside Binance’s control; it does not close the criminal case.

The FBI has published a long list of addresses it says hold or have held assets from the theft and are operated by, or closely linked to, TraderTraitor actors. Firms handling transfers can use the official alert directly rather than relying on copied lists that may become stale or incomplete. Binance users should use the exchange’s own status pages for withdrawal information and be wary of anyone claiming they can accelerate a refund.

For now, the confirmed change is the source and force of the attribution. What began as a high-confidence finding by private investigators is now an FBI warning to the wider crypto ecosystem. The unanswered questions are how much of the stolen value can be intercepted and what the full investigation will reveal about the controls that failed.