FBI urges blocking Binance theft-linked transactions; withdrawals remain unconfirmed

The FBI has urged cryptocurrency service providers to block transactions linked to the North Korean TraderTraitor operation it blames for the Binance theft, with associated addresses published on Ethereum, Bitcoin and Solana, The Jerusalem Post reports on November 1. Binance says it has replaced roughly nine-tenths of the stolen cryptocurrency and is taking steps to reinstate withdrawals. The supplied reporting does not confirm that access has resumed on its previously announced November 1 target date.⁴¹⁰³

Infographic

Enlarge

Freezing assets and covering losses

The Jerusalem Post reported on November 1 that Binance says it has replaced roughly nine-tenths of the stolen cryptocurrency and is working to reinstate withdrawals. The exchange had previously targeted November 1 for restoration, but the supplied reporting does not confirm that access has resumed. Replenishment is not a measure of stolen assets recovered.⁴³

The US Secret Service said it was helping identify, freeze, trace and recover the stolen funds, and would pursue those responsible. Binance said its US-facing exchange had not been affected and promised to cover every customer loss.²

Binance says it reserved about $6.34bn in company funds to cover losses, The Jerusalem Post reports. Binance was collaborating with authorities, blockchain companies and token providers to reclaim frozen assets and replenish customer balances.⁴¹²

Binance’s October 30 evening update specified that SAFU and corporate funds would cover the loss, and said about $3bn had been frozen on-chain. Earlier reporting put the verified frozen total at $2.54bn. The Straits Times stressed that freezing funds is not the same as recovering them. Associated Press and Cointelegraph reports described a temporary suspension of both deposits and withdrawals.¹³¹¹³⁶

Circle chief executive Jeremy Allaire said his company froze more than $800m associated with the incident, while Tether chief executive Paolo Ardoino reported freezing more than $1.5bn, according to Associated Press reporting. Cointelegraph also reported that Binance revoked authorization for the affected address and began tracing and recovering funds.¹¹⁶

The promise to reimburse customers may not itself be legally binding, experts told the BBC. Daniel Tunkel, a lawyer at London law firm Edwin Coe, said the legal position would depend on customers’ contracts and where they could bring proceedings against Binance if it failed to meet its obligations.²

How the funds moved

TRM Labs put the value of the assets when taken at approximately $6.36bn and described the incident as the largest recorded cryptocurrency theft. Its analysis said most transfers took place within about 20 minutes, beginning at 20:05 UTC, and that preparations had started at least 36 hours before the theft.⁹

Cointelegraph reported that, according to Binance’s preliminary inquiry, attackers may have used a DevOps engineer’s compromised laptop to enter a service container and initiate withdrawals without authorization. The exchange said nothing uncovered so far indicated that a wallet’s private key had been exposed, and the inquiry remained ongoing. Its October 30 evening update identified compromised hot wallets as the source of the stolen assets, without establishing the definitive route of access.⁶¹³

Blockaid’s preliminary assessment suggested that attackers misused compromised signing infrastructure rather than extracted a private key. The firm said a transaction targeting Binance 14 bundled 50 EIP-7702 authorizations, one of which matched the account’s required nonce and was accepted. It said the account was then delegated to an unverified sweeper contract capable of draining tokens and Ether. Arkham CEO Miguel Morel cautioned that there was insufficient information to distinguish stolen keys from compromised infrastructure.⁶

Binance co-CEO Richard Teng described the incident as involving a compromised laptop and malware intended to erase evidence of the intrusion, according to The Jerusalem Post. His account does not resolve the outstanding questions about the precise access and signing mechanism.⁴⁶

⁷

The FBI, US Secret Service and IRS Criminal Investigation urged private-sector entities to block transactions involving or derived from addresses used by TraderTraitor actors. The Jerusalem Post reports that the published addresses include wallets on Ethereum, Bitcoin and Solana. The FBI says the actors converted stolen assets primarily into Ethereum and expects further laundering through decentralised finance and instant swap services.¹⁰⁴

Lim Eul-chul told The Straits Times that, in North Korea’s wider operations, stolen cryptocurrency is obscured and converted to cash using crypto mixers or privately run exchanges. He said proceeds support military research, illicit purchases of weapons components and the defence industry. This general account does not establish that the stolen Binance assets have already been converted into cash.³

Attribution and the wider pattern

The FBI has attributed the theft of more than $6bn from Binance to North Korea, identifying the activity as TraderTraitor. Its October 31 notice dates the theft to on or about October 29. The attribution follows earlier high-confidence assessments by TRM Labs and Chainalysis linking the attack to North Korea. North Korea has denied using cybercrime to raise money.¹⁰⁷⁹²

The FBI previously identified TraderTraitor as responsible for the February 2025 Bybit attack, which involved $1.5bn. TRM Labs said the Binance theft was roughly four times that amount.¹⁹

The Guardian reported that North Korea has used cryptocurrency theft since 2017 to support its military, including its nuclear weapons programme. A UN panel said it was examining 58 suspected attacks by North Korea targeting businesses tied to cryptocurrency over the 2017–2023 period, collectively estimated at $3bn.¹

Ciaran Martin, the former head of the UK National Cyber Security Centre, told the Guardian that stronger defences at traditional banks appeared to explain the focus on cryptocurrency. He said more than 30 crypto hacks over the past decade involved sums of at least hundreds of millions of dollars, compared with zero or one bank cyberattack causing a loss above $100m.¹

The Straits Times also describes the 2024 DMM Bitcoin theft, which the FBI said involved a North Korean operative who impersonated a recruiter and sent a supposed job assessment embedded with malicious code, allowing the system to be breached and an employee’s identity to be assumed. The FBI separately attributed nearly $200m in thefts from Atomic Wallet, Alphapo and CoinsPaid in 2023 to TraderTraitor actors. These earlier cases do not establish how Binance was breached.³

South Korean intelligence estimated North Korea’s cyber force at around 8,400 personnel in 2024, The Straits Times reports. The FBI said the country developed its cyber capabilities by directing leading students into computer science and IT training.³