FBI Says North Korea Stole $6B From Binance, Names 628 Addresses

The FBI said Saturday that North Korea was responsible for the theft of more than $6 billion in crypto from Binance on or about Oct. 29. The bureau had earlier said only that it was aware of the incident.

Until now, the North Korea link came from private firms. Black Mint reported Oct. 30 that TRM Labs tied the attack to TraderTraitor, a North Korean state hacking unit, and Chainalysis said the same in its own analysis. The FBI alert now uses that name too, the same one it gave the group behind the $1.5 billion Bybit theft in February 2025.

628 addresses on a block list

The FBI, working with the Secret Service and IRS Criminal Investigation, said the hackers have been converting stolen assets mainly into ether. The bureau expects them to move next through DeFi apps and instant swap services.

How that laundering works: an instant swap service trades one coin for another in minutes, often without an account, so each hop makes the trail harder to follow. A block list fights back. Once an address is public, exchanges and node operators can refuse any transaction that touches it.

The alert lists 608 Ethereum addresses, 19 bitcoin addresses and one Solana address that it says hold or held stolen funds. It asks exchanges, DeFi services, blockchain analytics firms and THORChain node operators to block transfers linked to them. Reuters also reported the FBI finding Saturday.

What it changes for Binance users

Customer balances are a separate track. Binance has said it will cover customer losses, and on Saturday it said 90% of the stolen crypto had been replaced, with withdrawals set to start reopening in phases Sunday, Nov. 1, Reuters reported.

North Korea has denied it is behind such hacks in the past, the BBC reported.

In our opinion: the hunt now moves from the exchange to everyone downstream of it. Every swap desk and node operator that honors this list makes the stolen ether harder to cash out, and every one that ignores it becomes the weak link. Watch whether the FBI adds addresses as the funds move, and whether Binance's withdrawal restart on Sunday runs smoothly.