FBI Attributes $6.3B Binance Theft to North Korea's TraderTraitor, Publishes 628 Crypto Wallet Addresses
The FBI has attributed the theft of more than $6 billion in cryptocurrency from Binance to North Korea, naming the activity TraderTraitor. In an October 31 announcement, the bureau said the theft occurred on or around October 29, 2026, and published 628 addresses tied to the stolen funds. Binance estimates the loss at about $6.3 billion, with roughly $3 billion verified as frozen. The FBI, US Secret Service and IRS Criminal Investigation are asking crypto businesses to block transactions involving the listed addresses.
Detalhes técnicos
- Binance's first detailed explanation: a compromised DevOps engineer's laptop appeared to let the attacker reach a service container and submit unauthorised withdrawal transactions. Binance found no evidence of wallet private key leakage.
- Binance later identified additional breach points without explaining them publicly. It promised to cover all losses and to publish a technical report after its investigation.
- The FBI alert lists 608 Ethereum, 19 Bitcoin and 1 Solana addresses that hold or previously held stolen assets and are operated by or closely tied to TraderTraitor.
- Investigators have seen the attackers converting stolen assets mainly into Ethereum and expect further laundering via DeFi platforms and instant swap services.
- The FBI announcement does not explain how the laptop was compromised or give a full account of the attack.
Remediação
- THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other VASPs are asked to block transactions involving the listed addresses and funds derived from them.
- Anyone with information should contact an FBI field office or file a report with the Internet Crime Complaint Center (IC3).
Linha do tempo
-
FBI Attributes $6.3B Binance Theft to North Korea's TraderTraitor, Publishes 628 Crypto Wallet Addresses
ler a análise desta fonte ocultar
The FBI has attributed the theft of more than $6 billion in cryptocurrency from Binance to North Korea, naming the activity TraderTraitor. In an October 31 announcement, the bureau said the theft occurred on or around October 29, 2026, and published 628 addresses tied to the stolen funds. Binance estimates the loss at about $6.3 billion, with roughly $3 billion verified as frozen. The FBI, US Secret Service and IRS Criminal Investigation are asking crypto businesses to block transactions involving the listed addresses.
Technical Details
- Binance's first detailed explanation: a compromised DevOps engineer's laptop appeared to let the attacker reach a service container and submit unauthorised withdrawal transactions. Binance found no evidence of wallet private key leakage.
- Binance later identified additional breach points without explaining them publicly. It promised to cover all losses and to publish a technical report after its investigation.
- The FBI alert lists 608 Ethereum, 19 Bitcoin and 1 Solana addresses that hold or previously held stolen assets and are operated by or closely tied to TraderTraitor.
- Investigators have seen the attackers converting stolen assets mainly into Ethereum and expect further laundering via DeFi platforms and instant swap services.
- The FBI announcement does not explain how the laptop was compromised or give a full account of the attack.
Remediation
- THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other VASPs are asked to block transactions involving the listed addresses and funds derived from them.
- Anyone with information should contact an FBI field office or file a report with the Internet Crime Complaint Center (IC3).