FBI Attributes Binance Theft to TraderTraitor and Seeks DeFi Cooperation

What happened: The FBI, US Secret Service and IRS Criminal Investigation jointly attributed the $6.3 billion Binance hack to TraderTraitor, a North Korean state-sponsored unit tracked within Lazarus Group/APT38, in an advisory issued October 31. The FBI published more than 600 Ethereum addresses, fewer than 20 Bitcoin addresses and one Solana address, asking THORNode operators, RPC providers, instant exchanges, DeFi services and analytics firms to block associated transactions. Chainalysis and TRM Labs independently supported the attribution, with investigators identifying commingling with proceeds from an earlier Bitget exploit attributed to North Korea.

Why it matters: The address list provides specific intervention points, but Chainalysis CEO Jonathan Levin expects the laundering network to expand to tens of thousands of addresses over the coming weeks, suggesting that effective screening will require continued updates. Approximately $2.4 billion in stablecoins has reportedly been frozen, including more than $1.567 billion in USDT and $823 million in USDC; those freezes demonstrate issuer intervention, but do not establish that the assets have been returned to Binance. The practical question is how much additional movement service providers can interrupt as investigators trace conversions, with Ether identified as a primary conversion target.

Sources: CoinDesk; Cointelegraph.