The FBI has formally attributed the theft of more than $6 billion in virtual assets from Binance to North Korea, converting an earlier private-sector assessment into an official U.S. law-enforcement position. In an October 31 cyber alert, the bureau identified the activity as TraderTraitor and said the theft occurred on or about October 29. The notice also moved beyond attribution: it published cryptocurrency addresses and urged digital-asset infrastructure providers to block transactions involving or derived from them.

A formal attribution changes the public record

TRM Labs had already assessed with high confidence that a North Korea-linked TraderTraitor operation was responsible. That conclusion remained a security firm's judgment while Binance's own technical investigation was unfinished. The FBI statement is now the U.S. government's explicit attribution. It does not, however, publish the intelligence or forensic method behind that conclusion, and it does not resolve how the attackers first reached Binance's internal systems or signing infrastructure. Attribution and root-cause analysis remain separate questions.

Related reporting: FBI Attributes Binance Theft to North Korea’s TraderTraitor

Investigators are focused on the laundering path

The FBI said it and partners at the U.S. Secret Service and IRS Criminal Investigation observed TraderTraitor actors converting stolen assets primarily into ether. The bureau expects further laundering through decentralized-finance protocols and instant-swap services. That is a forward-looking warning about the likely route of funds, not confirmation that every listed asset has entered a DeFi service or that a particular protocol knowingly processed stolen property.

The blocking request reaches beyond exchanges

The alert asks THORNode operators, remote-procedure-call node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual-asset service providers to block transactions with or derived from addresses connected to the operation. This breadth matters because laundering can cross infrastructure that does not resemble a conventional centralized exchange. The request is intended to reduce the attackers' ability to fragment and convert funds while investigators and compliance teams continue tracing them.

Public address lists have practical limits

A published list gives screening teams a common starting point, but it is not a complete map of future activity. Assets can move to newly created addresses, pass through smart contracts or be split across chains. Providers also differ in their technical controls and legal obligations. The FBI's phrase "derived from" therefore requires transaction tracing rather than a simple comparison with one fixed list. Blocking can disrupt movement, but it does not by itself recover assets or prove who controls every downstream wallet.

Independent reporting confirms the new step

The Associated Press reported that the FBI tied the attack to TraderTraitor and asked exchanges, analytics companies and other participants to block transactions linked to identified addresses. AP also noted that Binance has promised to reimburse customers. That customer-protection pledge is separate from the attribution, the tracing effort and Binance's still-pending technical postmortem. A platform can replace customer assets without recovering the stolen funds or completing the investigation.

What remains unresolved

The most important missing evidence is a detailed Binance postmortem connecting the initial intrusion to the onchain transfers and explaining which controls failed. Investigators must also track whether the published addresses remain active, where funds move next and whether service providers can freeze or reject transactions before conversion. For now, the defensible conclusion is narrower than a closed case: U.S. law enforcement has formally attributed the theft and started a public disruption effort, while the technical cause, recovery total and full laundering route remain unsettled.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.