The FBI has attributed a virtual-asset theft exceeding $6 billion from Binance to North Korean actors tied to the malicious cyber campaign known as TraderTraitor, placing the alleged attack among the largest cryptocurrency thefts publicly linked to a state-backed group.
In an alert, the bureau said the attackers had begun converting stolen assets primarily into Ether and were likely to use decentralized finance protocols, instant swap providers, and cross-chain services to obscure the trail before moving funds onward. The FBI also connected the group to the separate theft of roughly $1.5 billion from Bybit last year.
The attribution arrives as blockchain monitors continue to trace large transfers through Tron wallets, decentralized swap services, and cross-chain liquidity networks. Binance said it had restored about 90% of affected assets, using company funds, portions of its Secure Asset Fund for Users, and a contract insurance fund, while it sought liquidity for the remaining tokens.
FBI urges services to block traced funds
The FBI published wallet addresses associated with the alleged theft and called on a broad range of cryptocurrency infrastructure providers to prevent further movement of the funds. Its request covered THORChain node operators, remote procedure call, or RPC, providers, instant exchange platforms, DeFi protocols, blockchain analytics firms, and other virtual-asset service providers.
The bureau asked those entities to block transactions involving the listed addresses as well as assets traceable to them after they move through new wallets. That request reflects the practical difficulty of containing major thefts once funds enter public blockchains: assets can be split into hundreds of transactions, routed through several networks, swapped for other tokens, and returned to prior addresses before moving again.
The FBI said it was coordinating its response with the U.S. Secret Service and IRS Criminal Investigation. It also asked people with information related to the activity to contact an FBI field office or the Internet Crime Complaint Center.
TraderTraitor is the name U.S. authorities use for a North Korean-linked campaign that has targeted cryptocurrency firms through social engineering, compromised software, and fraudulent employment-related approaches. The FBI's latest notice describes the group's theft activity as part of that continuing campaign rather than as an isolated breach.
Tron transfers show rapid wallet distribution
Onchain Lens said wallets associated with the attackers transferred 120 million TRX, worth approximately $38.78 million at the price observed by the platform. The tokens were then distributed across multiple destination addresses.
Some transfers moved through several wallets before returning to addresses used earlier in the flow, according to Onchain Lens. Such recycling can make automated screening more difficult, particularly when the same funds are divided into smaller amounts and moved across networks with different monitoring tools.
Elliptic, a blockchain analytics company, reported that a principal Tron distribution wallet had sent about $93.5 million to around 150 wallets while continuing to receive large incoming replenishments. It recorded an accelerated transfer rate of roughly $3 million to $7 million an hour during an overnight period.
The analytics firm described a pattern consistent with automated distribution. It said the main wallet sent funds every hour for 31 consecutive hours, with its longest interruption lasting 46 minutes. Recipient wallets frequently moved the funds again within about two minutes, leaving little time for centralized services to identify and freeze assets before another transfer.
Elliptic tracked about $25 million reaching THORChain as of 16:11 on the day it published the observation. It also recorded approximately $5.3 million flowing into SunSwap and $1.8 million into Bitget Swap. These services can facilitate exchanges between assets or networks, allowing stolen tokens to be converted and redistributed without relying on a single conventional trading venue.
Binance says most assets have been replenished
Binance said roughly 90% of affected assets had been refilled, improving from an earlier disclosed figure of about 80%. According to the company, full reserves had been restored for BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC.
The outstanding portion consists largely of lower-liquidity tokens, Binance said. Sourcing those assets through market purchases and over-the-counter transactions can take longer because buying large quantities too quickly may move prices sharply or encounter limited available supply.
The company said its recovery funding came from three sources: corporate funds, a portion of its SAFU reserve, and a contract insurance fund. Binance co-CEO He said half of the funds held at the SAFU address would be allocated to cover losses, while the remaining half would stay in the reserve.
On-chain data cited in the report showed the SAFU address transferring 7,500 BTC in three transactions, leaving another 7,500 BTC at the address. The remaining holdings were valued at roughly $580 million at the reported Bitcoin price.
Binance also said it completed a proof-of-reserves snapshot at 08:00 Beijing time on October 31 and expected to generate a full zero-knowledge proof on November 3. A zero-knowledge proof is a cryptographic method designed to demonstrate that an exchange holds sufficient assets without publicly exposing all wallet balances and customer data.
Withdrawal services were still targeted for restoration, Binance said, with further operational details expected separately. The FBI's attribution and the continuing on-chain flows place pressure on wallet-screening providers and swap services to identify traceable assets quickly, while Binance's replenishment effort seeks to limit the immediate impact on customers whose funds were caught in the theft.
Worried about hacks and phishing? Strengthen your defenses with Toobit’s guide on crypto safety standards today.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
