FBI publishes 628 North Korean laundering addresses as Binance replenishes 90% of stolen assets

The U.S. Federal Bureau of Investigation has formally attributed the Binance hack to North Korea. In a cyber alert posted on its website on Oct. 31 U.S. time, the FBI said North Korea "was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026," and that it refers to the activity as "TraderTraitor." The alert is the first official U.S. law enforcement finding, following blockchain analytics firm TRM Labs naming the same group on Oct. 30.

Together with the U.S. Secret Service (USSS) and IRS Criminal Investigation (IRS-CI), the FBI published 628 wallet addresses used by the attackers and asked the crypto industry to block transactions with them.

An official attribution in about two days

It took the FBI a little over two days to name North Korea. When about $1.5 billion was stolen from Bybit in February 2025, the bureau issued a similar alert on Feb. 26, five days after the Feb. 21 theft. It also called the culprits TraderTraitor at the time. The timeline of the current case is below (KST, except the U.S. date of the FBI alert).

1. Oct. 30, around 5:05 a.m.Large outflows begin from Binance hot wallets (internet-connected wallets used for withdrawals); losses of about $6.3 billion
2. Oct. 30TRM Labs names North Korea's TraderTraitor as the attacker in a blog post
3. Oct. 31, 4:33 a.m.Binance "Security Incident Update #2": about 80% of losses covered
4. Oct. 31, 11:30 p.m.Binance "Update #3": coverage rises to 90%
5. Nov. 1, 1:15 a.m.Binance says it has completed a transfer of 7,499 BTC from its Secure Asset Fund for Users (SAFU)
6. Oct. 31 (U.S. time)FBI, USSS and IRS-CI attribute the theft to North Korea and publish laundering addresses

Converted to ether, headed for DeFi

The FBI said TraderTraitor actors have been "converting stolen assets primarily into Ethereum (ETH)." It said the assets are expected to be further laundered through decentralized finance (DeFi) and instant swap services.

The published list includes 608 Ethereum addresses, 19 bitcoin addresses and one Solana address. The FBI said they "are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors." It addressed its request to THORChain node (THORNode) operators, RPC node operators (servers that connect wallets to blockchains), instant exchanges, DeFi services and blockchain analytics firms, among others. Anyone with information was asked to contact a local FBI field office or the Internet Crime Complaint Center (IC3).

"block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets"

FBI cyber alert

According to Binance, industry partners have frozen about $3 billion in assets. Separately from the freezes, the FBI asked THORChain node operators, DeFi services and others to block transactions with the listed addresses.

Binance at 90%, with less liquid tokens left

Binance said in an update late on Oct. 31 KST that the covered amount "is now up to 90%." BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed at 100%. The remaining 10% consists of tokens outside those ten, which are less liquid and may take longer to source. The funds came from part of SAFU, part of the futures insurance fund and Binance's corporate treasury. Binance said it will replenish SAFU to about $1 billion.

Binance also took a new proof-of-reserves (PoR) snapshot as of 00:00 UTC on Oct. 31. The full zero-knowledge proof, which lets users verify their assets are at least 1:1 backed, takes 40 to 50 hours to generate and is expected around Nov. 3 (UTC). Binance said it remains on track to reopen withdrawals "on Sunday, 2026-11-01" and will share details once confirmed.

Upbit's Binance withdrawal warning still up

Bitcoin traded at $77,712 on Binance at 10:30 a.m. KST on Nov. 1, up 0.3% over 24 hours. At the same time, ether was at $2,266 and BNB at $704, while the bitcoin perpetual futures funding rate was a normal 0.01%. On Upbit, bitcoin traded at 104,545,000 won and ether at 3,047,000 won. Bitcoin traded at a kimchi premium (the gap between prices on Korean exchanges and global markets) of about 0.8% on Upbit relative to Binance. BNB is not listed on Upbit's Korean won market; it traded at 948,500 won on Bithumb.

Upbit's Oct. 30 notice cautioning users about withdrawals to Binance had not been lifted as of 10:30 a.m. KST on Nov. 1.