FBI Confirms North Korea Behind Binance Hack: TraderTraitor and Stolen Fund Tracing

 

The Federal Bureau of Investigation issued a notice on October 31, 2026 attributing the theft from Binance on October 29 to the North Korean group TraderTraitor, publishing 628 associated addresses alongside the Secret Service and IRS Criminal Investigation. The list covers 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address, and the notice asks crypto businesses and infrastructure operators to block transactions involving them, including funds derived from them. This marks the point at which attribution moved from blockchain analytics firms to a law enforcement determination.

 

How the money has moved is the incident's other distinguishing feature. Tracking by Elliptic shows the main distribution wallet on Tron paying out once an hour for 31 consecutive hours, with a longest gap of 46 minutes, transfers almost never less than 30 seconds apart, and receiving wallets forwarding within about two minutes. Co-founder Tom Robinson described it this way: "The pattern is repetitive and static: the same sizes, the same rhythm, the same routes, hour after hour." That is not a human cadence. The timeline and the figures for the attack itself are set out in a separate account of the Binance security incident.

 

 

 

The FBI notice attributes the theft to TraderTraitor and publishes 628 addresses, none of them on Tron, which is the chain carrying the largest share of the laundering. About $6.43 billion was taken across 11 blockchains, of which Elliptic has verified roughly $2.85 billion frozen. Around $628 million moved on Tron, and after Tether froze 378.7 million USDT, about $242 million of the remaining $249 million was moved within two days. THORChain paused automatically after an Ethereum block reorganization exposed a double-refund flaw, interrupting cross-chain swaps as a side effect. Binance resumed withdrawals in phases on November 1, recording $3.64 billion in net outflows on the first day, and says it has replaced 95% of the stolen assets.

 

 

The notice was issued on October 31 by the FBI together with the Secret Service and IRS Criminal Investigation, stating that the listed addresses hold or previously held assets from the theft and are operated by or closely connected to TraderTraitor hackers. Its figure for the theft is "more than $6 billion," against Binance's own estimate of about $6.3 billion and Elliptic's count of about $6.43 billion, all describing the same event on different bases.

 

The list of parties asked to block transactions is unusually specific: THORNode operators, RPC node operators, instant exchange services, DeFi services, blockchain analytics firms and other virtual asset service providers. That list is itself a statement of where investigators expect the money to go, namely through decentralized protocols and instant swap services rather than conventional exchanges. The notice adds that the stolen assets have been observed converting primarily into Ethereum.

 

None of the 628 addresses are on Tron, which is a gap in the notice's coverage. On-chain analysis puts Tron at the center of the laundering, while the published list covers only Ethereum, Bitcoin and Solana.

 

 

TraderTraitor is a United States government codename for a financially motivated subgroup within the Lazarus structure, with associated aliases including APT38, BlueNoroff and Stardust Chollima, a mapping confirmed in the April 2022 joint advisory from the FBI, CISA and the US Treasury. Other security vendors track the same activity as UNC4899 and Jade Sleet.

 

 

One thread runs through the whole record: the entry point is almost always a person with privileged access rather than the cryptography or the contracts. Ronin began with a job offer, DMM Bitcoin with a coding test, Bybit with an application on a developer's machine, and Binance with an operations endpoint. The signing infrastructure was then used to submit unauthorized withdrawal transactions, and the EIP-7702 delegation mechanism that made the Ethereum leg possible is a protocol-level Ethereum feature rather than a vulnerability. What gets breached is the boundary between people and permissions.

 

 

 

According to figures published by the on-chain analyst SomaXBT, a contributor to the Security Alliance, about $628 million moved on Tron. After Tether froze 378.7 million USDT, roughly $249 million remained available, and about $242 million of it was moved within two days. Of that $242 million, around $194 million left Tron through bridges and swap services, about $26 million stayed on the chain, and about $22 million was consumed by fees, slippage and price movement.

 

 

All of these are third-party services used by the launderers rather than parties to the theft. The distribution of amounts and transaction counts describes the method: the 1,367 deposits into Symbiosis and the 2,697 into THORChain both break large sums into a stream of small ones, while the automatic re-sending after failures on the Chainflip route indicates a process driven by software rather than by an operator.

 

Chainalysis separately observed stablecoins being deposited into DeFi protocols on Tron in exchange for receipt tokens that cannot be frozen, with other analysts identifying the protocol as JustLend, and TRM Labs recorded 300 million USDT arriving at a wallet that then began supplying JustLend. Tronscan data shows about 234 million USDT swapped for TRX and a further 65.99 million USDT sent to a wallet that had already been frozen.

 

 

The conversions are a direct product of the freeze mechanism. Stablecoins are minted by an issuer whose contract retains a blacklist function the issuer can call unilaterally, while TRX, ETH and BTC have no issuer and therefore no equivalent switch. Stablecoins were frozen at a far higher rate than native assets in this incident, and the attacker's decision to dump USDT at a discount for ETH before the freezes landed, then to swap USDT for TRX and DeFi receipt tokens on Tron, follows the same logic throughout: trade freezable assets for unfreezable ones and accept the cost in fees and slippage. On the THORChain route alone that cost ran to about 12%, per SomaXBT's figures.

 

 

The cadence Elliptic recorded carries machine signatures. The main wallet was topped up in batches of about $40 million, outflows held at $7 million to $11 million per hour, and roughly $196 million went overnight to about 200 wallets. Swaps on THORChain ran at about 100 every two hours, with amounts reused repeatedly and one value appearing 19 times. When a bridge rejected deposits, funds were automatically re-sent to the same destination from new wallets. Robinson noted specifically that this does not appear to involve AI agents, and that the Bybit laundering had "followed human working patterns." The difference here is that the process has been scripted end to end.

 

 

At 11:34 UTC on October 31, a one-block reorganization on Ethereum removed a 10 ETH deposit that THORChain had already credited. The swap then failed to meet its price limit and triggered a refund, returning funds the vault had never received along with the sender's actual deposit, so the same 10 ETH was paid out twice. The excess payout set off an automatic pause.

 

Node operators subsequently paused swaps involving 10 of the 13 connected networks, including Bitcoin, Ethereum, Solana and Tron, while trading continued on Avalanche, Base and XRP. Tron had been halted since around midday on October 31 and remained so as of 13:20 US Eastern time on November 1. THORChain said its nodes "will decide to re-enable chains as they are deemed safe."

 

Chainalysis assessed that the pause had "inadvertently delayed the laundering of a significant amount of funds stolen from Binance," because it was "preventing all users, including DPRK's money launderers, from using cross-chain swaps." The phrase "all users" is the operative one: a decentralized protocol cannot close itself to particular addresses, so blocking and interrupting are the same action here. THORChain technical co-founder Chad Barraford responded to the FBI's request by noting that "THORNode operators have zero information that isn't already public and readily available in real time," without saying whether nodes would act on the list. The cross-chain service Symbiosis said that "some mechanisms have gaps" and that it was "closing them as we go."

 

 

Binance said on October 31 that it had allocated more than $6.34 billion of company funds to absorb the losses and had used them to purchase tokens replacing about 90% of the stolen assets, with the remaining 10% described as less liquid and slower to source in the quantities required. Its statement read: "Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident."

 

Withdrawals reopened in phases on November 1, beginning with Bitcoin, in a window running from 06:00 to 15:30 GMT. Binance reported processing $4.65 billion in withdrawals and $1.01 billion in deposits over that period, for net outflows of $3.64 billion, which it characterized as about 2.1% of assets under management. The same day it put the replacement of stolen assets at 95%.

 

The scale of those outflows describes what a portion of users chose to do. For anyone preparing to spread holdings across venues, the question to settle before moving anything is usually whether the destination supports the tokens held and whether they can be used for futures and Earn once they arrive, and the asset support checker returns that status across all three from an uploaded holdings screenshot, with no login and no account permissions requested. For a comparison on fees and regional availability, a side-by-side review of eight exchanges sets out standard-tier rates, the first discount tier a trader can realistically reach, and where each venue is available, which tracks real cost more closely than headline fees do. As for whether the books balance once assets are replenished, the test is the first proof of reserves published afterwards, and the structure of such a report and the parts a user can check independently are visible on MEXC's proof of reserves page.

 

 

A formal attribution changes the chain of responsibility rather than the facts. Before the FBI notice, the North Korea assessment came from TRM Labs, Chainalysis and Elliptic, which are commercial analyses. After it, blocking requests carry law enforcement backing, and the character of a service provider's decision to keep processing transactions against a published list changes with them. That is what the notice actually does: it converts a technical finding into a trigger for compliance obligations.

 

The gap it leaves is worth equal attention. Not one of the 628 addresses sits on Tron, the chain where roughly $242 million moved in two days. Address lists lag fund movement by their nature, and when distribution is script-driven and receiving wallets forward within about two minutes, a static list has a useful life measured in minutes. That is not an oversight by investigators; it is structural to this kind of contest.

 

The detail I think will be remembered longest concerns THORChain. What actually interrupted the laundering was not any party's blocking decision but an automatic pause triggered by a refund flaw that an Ethereum reorganization exposed. An entirely accidental technical fault achieved more than every deliberate measure taken. It also illustrates the bind decentralized protocols face in these situations: they cannot close selectively, so the choice is open to everyone or closed to everyone. How cross-chain swap venues are governed is likely to be the longest-running question this incident leaves behind, rather than the attribution itself.

 

 

 

Yes. The FBI issued a notice on October 31, 2026, together with the Secret Service and IRS Criminal Investigation, attributing the theft to the North Korean group TraderTraitor and publishing 628 associated addresses, with the amount described as more than $6 billion.

 

 

A United States government codename for a financially motivated subgroup within the Lazarus structure, with aliases including APT38, BlueNoroff and Stardust Chollima. Incidents previously attributed to it include Ronin Network in 2022 at about $620 million, DMM Bitcoin in 2024 at about $308 million, and Bybit in February 2025 at about $1.5 billion.

 

 

Spread across 11 blockchains, with roughly $2.85 billion verified frozen by Elliptic. About $628 million moved on Tron, and after Tether froze 378.7 million USDT, about $242 million of the remainder left within two days through cross-chain services including Relay, THORChain, Chainflip and Symbiosis, with a further $41.7 million routed via Bitget Wallet to an unresolved destination.

 

 

Stablecoins are minted by an issuer whose contract retains a blacklist function the issuer can call unilaterally, while TRX, ETH and BTC have no issuer and no equivalent mechanism. Trading freezable assets for unfreezable ones costs fees and slippage, running to about 12% on the THORChain route alone.

 

 

A one-block Ethereum reorganization at 11:34 UTC on October 31 removed a 10 ETH deposit that had already been credited, and the subsequent refund process paid out the same 10 ETH twice, triggering an automatic pause. Node operators then halted swaps on 10 of the 13 connected networks. Chainalysis said the pause inadvertently delayed a significant amount of the laundering.

 

 

They reopened in phases on November 1, beginning with Bitcoin, in a window from 06:00 to 15:30 GMT. Binance processed $4.65 billion in withdrawals and $1.01 billion in deposits during that period, for net outflows of $3.64 billion.

 

 

Binance says it allocated more than $6.34 billion of company funds to absorb the losses, reporting on October 31 that it had replaced about 90% of the stolen assets and on November 1 that the figure had reached 95%, with the remainder described as less liquid and slower to source.

 

 

Its effect is limited. The list covers Ethereum, Bitcoin and Solana but contains no Tron addresses, and Tron carries the largest share of the laundering. Distribution is script-driven and receiving wallets typically forward within about two minutes, so a static list has a short useful life. Its main value is in giving service providers a clear compliance basis.

 

 

It is fully scripted. Elliptic recorded the main wallet paying out hourly for 31 consecutive hours with amounts and routes reused repeatedly, and funds automatically re-sent from new wallets whenever a bridge rejected a deposit. The firm noted that the Bybit laundering still followed human working patterns, while this operation shows no such signature.

 

 

This article is for general information only and does not constitute investment, financial, legal or tax advice. Figures are current as of 08:30 UTC on November 2, 2026, and the investigation and fund tracing are ongoing, so amounts, attribution conclusions and service status may change with subsequent official disclosures. Crypto assets are highly volatile and can produce losses exceeding the initial outlay. Readers should verify the original disclosures and judge independently, consulting a qualified professional where appropriate.

 

 

James Mitchell specializes in technical analysis, market trends, and trading strategies for both Bitcoin and altcoins. Based in London, he has over 10 years of experience in financial markets. Before joining MEXC Learn, James worked as a senior analyst at a leading European investment firm, where he developed expertise in risk management and quantitative trading. His transition to cryptocurrency markets began in 2017, and he has since become recognized for his data-driven approach. He holds a Master's degree in Financial Economics from the London School of Economics. His analytical approach combines traditional technical analysis with on-chain metrics to provide readers with actionable insights.

 

Areas of Expertise: Technical Analysis, Market Trends and Cycles, Trading Strategies, Bitcoin and Altcoin Analysis, Risk Management.

 

 

 

Want the fastest access to MEXC's latest updates? Join our official Telegram group now!

MEXC Platform: Download App | Zero Fee Trading | Buy USDT Now

Join MEXC Community: X (Twitter) | Telegram | Discord

Get Insights: MEXC Learn | Terms of Service | MEXC Blog | MEXC News

Account Verification: Understand KYC | How to Complete KYC

External Content Platforms: Substack | Medium | Paragraph | LinkedIn | X(News)