FBI Blames North Korea’s TraderTraitor for Binance Hack and Urges Crypto Industry to Block Addresses

The FBI has confirmed that North Korea’s TraderTraitor group, a unit of the Lazarus Group, was behind the theft of more than $6 billion from Binance. In a Saturday notice, it said the hackers have mostly been converting stolen funds into ether and are likely to use swap services and other DeFi tools to keep laundering them. The agency, together with the Secret Service and IRS criminal investigators, urged THORNode and RPC node operators, instant exchanges, DeFi services and analytics firms to block transactions linked to the listed addresses.

Hundreds of Flagged Wallet Addresses

The notice lists over 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address. Stablecoin issuers have frozen more than $2.4 billion, but the attackers continue moving much of the rest. Binance says it has replaced 90% of the stolen assets and plans to reopen withdrawals on Sunday.

Chainalysis Warns of a Widening Laundering Network

Chainalysis CEO Jonathan Levin said the attackers have already used thousands of addresses and expects tens of thousands in the coming weeks. He explained that the thieves hold more money than their trusted laundering channels can handle, so funds will spread to bridges, instant exchanges and swappers. President Donald Trump said his administration would talk to North Korea about it.