FBI blames North Korea's TraderTraitor for the $6.3 billion Binance theft and lists hundreds of laundering addresses

The FBI has formally attributed the October 29 theft from Binance to TraderTraitor, a North Korean state-sponsored group. Exchanges and blockchain analysts estimate the loss at about $6.3 billion, the largest cryptocurrency theft on record. In an alert published October 31, the bureau said North Korea was responsible for stealing more than $6 billion in virtual assets. BleepingComputer notes that the group is also tracked as Lazarus Group, Jade Sleet and APT38. Help Net Security reports that it is the same group the FBI named in the $1.5 billion Bybit hack of February 2025. TRM Labs and Chainalysis had already linked the theft to the group within a day. Working with the US Secret Service and IRS Criminal Investigation, the FBI says it has watched TraderTraitor convert the stolen assets mainly into Ethereum. It expects the funds to be laundered further through DeFi and instant swap services. According to SecurityWeek, the alert lists 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address. The agencies urged exchanges, decentralized finance companies and other crypto operators to block transactions with those addresses or with funds derived from them. The Record reports that the attackers have spent days running thousands of seemingly automated transactions to hide where the funds came from. Binance has said the intrusion may have started on a DevOps engineer's compromised laptop, and it has pledged to cover all losses.