Washington, 31 October. The FBI said North Korea is behind the theft of more than 6 billion dollars in virtual assets from the cryptocurrency exchange Binance on 29 October, and calls the hackers’ activity “TraderTraitor”, according to an FBI alert.
Together with the US Secret Service and the criminal investigation arm of the tax authority (IRS-CI), the FBI has observed members of the group converting the stolen funds mainly into ether (Ethereum, ETH), and expects the assets to be laundered further through decentralised finance (DeFi) and instant-swap services. The three agencies urged private companies, including operators of THORNode and RPC nodes, instant-swap and DeFi services, blockchain analytics firms and other virtual-asset service providers, to block transactions with the addresses used by “TraderTraitor” and transactions derived from them; the alert lists the addresses. A THORNode is a node of the THORChain network, through which cryptocurrencies are swapped between different blockchains, while RPC nodes are servers through which applications send requests to a blockchain. The FBI asks anyone with information about the theft or its laundering to contact a local field office or the Internet Crime Complaint Center (IC3), Newsweek reports.
Binance itself put the damage at about 6.3 billion dollars and said losses would be covered by the SAFU fund and company money, not by customers; Binance.US said it was not affected by the breach, ABC News reported. At first the exchange linked the breach to the compromised laptop of a DevOps engineer; it later found other points of entry but did not say where. According to Richard Teng, one of Binance’s leaders, the attackers used a self-destruct mechanism that erases tools and traces, and through the EIP-7702 mechanism gained the right to carry out operations from one of the “hot” wallets, bypassing the usual approval; the exchange’s own hot wallets were hit and customer assets were not affected, TokenPost reported. A hot wallet is connected to the internet so that funds can be paid out quickly, while most customer money is kept in “cold” wallets disconnected from the network. EIP-7702 is a proposal for improving Ethereum that lets an ordinary wallet hand the right to carry out operations to a program, a contract.
On 30 October the exchange said it had replenished 80% of the stolen funds, and on 31 October Teng said 90% had been replenished and that the ten largest tokens, among them BTC, ETH, USDT and BNB, were fully covered; Binance is buying the rest on the market and from over-the-counter brokers, Blockonomi writes. The exchange took a new snapshot of its reserves at 00:00 UTC on 31 October; by its own estimate the full cryptographic proof takes 40–50 hours and is expected by 3 November, whereas Teng had earlier named 2 November. Binance still intends to restore withdrawals on 1 November, in stages. Whether withdrawals were open by the morning of 1 November is not confirmed in the reports found.
What it means: The theft now has an official culprit in the eyes of the United States, and businesses have a request from the agencies to block the addresses the money is moving to. For Binance customers something else matters more: when withdrawals reopen and when the full reserves report is ready.
What we know now: The FBI has named the culprit: North Korea, the “TraderTraitor” group. Binance puts the damage at about 6.3 billion dollars, and 90% of the stolen funds have already been replenished. Binance reported as early as 30 October that about 3 billion dollars had been frozen on the blockchain; how much of that cannot be recovered is not stated. It remains unknown whether withdrawals have been restored, what the technical analysis of the breach will show (the exchange promises to publish it once the facts are verified), and when the full reserves report will appear.
Background: “TraderTraitor” is the same name under which the FBI in February 2025 blamed North Korea for the theft of about 1.5 billion dollars from the exchange Bybit, NBC News wrote. The current sum, more than 6 billion dollars, is more than four times larger.
We have also reported that Binance set aside 6.34 billion dollars to cover hack losses, that the National Bank said Kazakhstan’s crypto reserve was not affected by the hack, and on the North Korean trail and the engineer’s laptop.
