EN PT-BR
← Voltar ao feed
high cryptocurrency financial services

FBI attributes $6.3B Binance heist to North Korea's TraderTraitor, flags 600+ laundering addresses

1 fonte(s) · 1 atualização(ões) · publicado 02/11/2026 05:40 · coletado há 1 hora

The FBI, with the USSS and IRS-CI, formally attributed the October 29 theft from Binance hot wallets to North Korean state-sponsored group TraderTraitor. Binance estimates losses at about $6.3 billion (Elliptic: $6.43 billion across 11 blockchains), the largest crypto theft on record. The FBI published 608 Ethereum, 19 Bitcoin and 1 Solana addresses that hold or held proceeds, and asked THORChain node operators, RPC node operators, instant exchanges, DeFi services and analytics firms to refuse linked transactions. Laundering appears heavily automated and is expected to take months.

Detalhes técnicos

  • Hackers emptied hot wallets on multiple blockchains, moving most funds in roughly 20 minutes.
  • Binance first suspected a compromised DevOps engineer laptop, but co-CEO Richard Teng said later investigation found additional breach points and that the attack "was not carried out by one person".
  • The attacker deployed a self-destruct mechanism that wiped tooling and evidence.
  • Use of Ethereum's EIP-7702 delegation feature "did not pass through our normal approval controls".
  • The FBI observed conversion of stolen assets primarily into ETH, followed by DeFi and instant swap services.
  • Elliptic: $2.85 billion frozen or seized; the attacker controls about $3.25 billion non-freezable assets across 800+ addresses (about 584,000 ETH, 18,327 BTC, 233 million XRP).
  • The main Tron distribution wallet paid out hourly around the clock; when a bridge refused deposits, funds were rerouted through fresh wallets. About $196 million went to ~200 wallets by late October 31, with THORChain the largest exit (~$31 million).
  • Chainalysis also noted automation patterns, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.
  • TRM Labs and Chainalysis linked the attack to TraderTraitor within hours. The same group was blamed for the $1.5 billion Bybit hack in February 2025.

Remediação

  • Crypto services should block transactions involving the FBI-listed addresses.
  • Binance resumed withdrawals in phases from November 1, has replaced about 95% of stolen funds with company funds and promised a technical post-mortem.

Linha do tempo

  1. securityweek.com ↗ · pub. 02/11/2026 05:40 · coletado 02/11 06:00 primeiro registro

    FBI attributes $6.3B Binance heist to North Korea's TraderTraitor, flags 600+ laundering addresses

    ler a análise desta fonte

    The FBI, with the USSS and IRS-CI, formally attributed the October 29 theft from Binance hot wallets to North Korean state-sponsored group TraderTraitor. Binance estimates losses at about $6.3 billion (Elliptic: $6.43 billion across 11 blockchains), the largest crypto theft on record. The FBI published 608 Ethereum, 19 Bitcoin and 1 Solana addresses that hold or held proceeds, and asked THORChain node operators, RPC node operators, instant exchanges, DeFi services and analytics firms to refuse linked transactions. Laundering appears heavily automated and is expected to take months.

    Technical Details

    • Hackers emptied hot wallets on multiple blockchains, moving most funds in roughly 20 minutes.
    • Binance first suspected a compromised DevOps engineer laptop, but co-CEO Richard Teng said later investigation found additional breach points and that the attack "was not carried out by one person".
    • The attacker deployed a self-destruct mechanism that wiped tooling and evidence.
    • Use of Ethereum's EIP-7702 delegation feature "did not pass through our normal approval controls".
    • The FBI observed conversion of stolen assets primarily into ETH, followed by DeFi and instant swap services.
    • Elliptic: $2.85 billion frozen or seized; the attacker controls about $3.25 billion non-freezable assets across 800+ addresses (about 584,000 ETH, 18,327 BTC, 233 million XRP).
    • The main Tron distribution wallet paid out hourly around the clock; when a bridge refused deposits, funds were rerouted through fresh wallets. About $196 million went to ~200 wallets by late October 31, with THORChain the largest exit (~$31 million).
    • Chainalysis also noted automation patterns, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.
    • TRM Labs and Chainalysis linked the attack to TraderTraitor within hours. The same group was blamed for the $1.5 billion Bybit hack in February 2025.

    Remediation

    • Crypto services should block transactions involving the FBI-listed addresses.
    • Binance resumed withdrawals in phases from November 1, has replaced about 95% of stolen funds with company funds and promised a technical post-mortem.