From Decrypt · By Decrypt Agent
In brief
The FBI said North Korea's TraderTraitor was responsible for the theft of more than $6 billion from Binance, and published hundreds of addresses linked to the hack.
Binance began restoring withdrawals on Sunday, processing $4.65 billion in withdrawals and $1.01 billion in deposits in the first nine and a half hours.
The exchange said the net outflow represented 2.1% of its $171 billion in assets, and it has since reopened fiat withdrawals, including U.S. dollars.
The FBI has confirmed that North Korea was behind last week's theft of more than $6 billion from Binance, as the exchange began reopening withdrawals and reported billions of dollars leaving the platform.
In an alert published on Saturday, the FBI said the attack was carried out by North Korean hackers it refers to as "TraderTraitor," confirming the attribution blockchain analytics firms TRM Labs and Chainalysis made on Friday.
The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North… pic.twitter.com/TBUvUFln4n
— FBI Cyber Branch (@FBICyberBranch) October 31, 2026
The FBI, together with the Secret Service and IRS Criminal Investigation, has seen the hackers converting stolen assets mainly into Ethereum, and expects them to launder the funds further through DeFi and instant swap services, the bureau said. It urged node operators, instant exchanges, DeFi services, blockchain analytics firms and other crypto businesses to block transactions involving hundreds of Ethereum addresses, 19 Bitcoin addresses and one Solana address it linked to the theft.
The Secret Service, which is also investigating the theft, said on Sunday that its investigators worked with industry partners to identify and freeze "a significant portion" of the stolen crypto within minutes of the attack. That work continues with the FBI, IRS Criminal Investigation, the U.S. Attorney's Offices for Washington, D.C. and the Central District of California, and the Justice Department's computer crime and national security divisions, the agency said.
Myriad: Where does ETH go next? Click to make your prediction.
The laundering is already well underway. After the attack, the hackers moved more than $500 million on Tron through more than 1,000 addresses, over 3,000 deposits and several Tron-based DeFi protocols, blockchain analytics firm Chainalysis said on Sunday. Most of those staging wallets have now been drained, with funds leaving Tron through cross-chain services including Chainflip, Relay, THORChain and NEAR for dozens of fresh wallets on Ethereum, Bitcoin and other chains, and the launderers have started moving onto Solana, the firm said.