FBI Blames North Korea for $6B Binance Exploit

The Federal Bureau of Investigation announced on Oct. 31 that the Democratic People's Republic of Korea orchestrated the theft of more than $6 billion in virtual assets from Binance ¹. According to the bureau, the breach took place on or around Oct. 29 and was conducted by the state-sponsored cyber unit tracked as TraderTraitor ¹.

Investigators from the FBI, the US Secret Service, and Internal Revenue Service Criminal Investigation found that the group has converted the stolen proceeds predominantly into $ETH ¹. The federal agencies warned that the operatives intend to channel the capital through decentralized finance protocols and instant swap services to obscure the transaction trail ¹.

Federal Alert Urges Freezes

In response to the movement of capital, the FBI and its investigative partners called on private infrastructure operators to intervene ¹. Federal agencies urged decentralized exchange participants, THORChain node operators, RPC providers, instant platforms, and blockchain forensics firms to block all transfers originating from or interacting with the network of illicit wallets ¹. The bureau published an extensive registry of associated Ethereum deposit addresses tied directly to the extraction and laundering campaign ¹.

The exploit follows previous large-scale intrusions attributed to Pyongyang, which has systematically deployed hacking teams against digital asset infrastructure ¹. Chainalysis previously reported that North Korean hackers stole a record $2.02 billion in crypto in 2025, marking the Binance heist as the single largest recorded attack carried out by the state. The operational footprint further underscores growing pressure on cross-chain infrastructure and transaction validation endpoints used to route illicit liquidity ¹. At the time of writing, Bitcoin was trading at $77,839, while Ethereum stood at $2,268 amidst broader market caution.

Federal investigators directed firms and victims with relevant operational telemetry to submit leads to local field offices or the Internet Crime Complaint Center ¹. Industry compliance teams face immediate operational pressure to blacklist the listed addresses across cross-chain bridges and node access points to disrupt further cash-out attempts ¹.