TL;DR
- The FBI formally attributed the theft of more than $6 billion from Binance to North Korea’s TraderTraitor operation and published addresses linked to the stolen assets.
- Binance restored withdrawals in phases after replenishing about 95% of affected assets, recording roughly $3.64 billion in net outflows during the first nine and a half hours.
- Authorities expect laundering through DeFi and instant-swap services and are urging infrastructure providers to block related transactions.
The FBI has formally attributed the theft of more than $6 billion from Binance to North Korea’s TraderTraitor operation, identifying the activity as a North Korean malicious cyber operation. In an official cyber alert, the bureau said stolen assets were being converted primarily into ETH before expected laundering through DeFi and instant-swap services. The disclosure arrives as Binance restores withdrawals across its exchange infrastructure following the security shutdown.
FBI Tracks TraderTraitor Funds as Binance Restores Withdrawals
The FBI said TraderTraitor-controlled or closely connected addresses are holding or have held assets from the theft, publishing a large set of Ethereum addresses alongside 19 Bitcoin addresses and one Solana address. The bureau, Secret Service and IRS Criminal Investigation urged node operators, instant exchanges, DeFi services, analytics firms and other virtual-asset providers to block transactions involving or derived from those addresses. The attribution follows earlier private-sector findings linking TraderTraitor to the Binance breach.
Binance, meanwhile, began restoring withdrawals in phases after replenishing approximately 95% of the affected assets. During the first nine and a half hours after withdrawals reopened, customers withdrew about $4.65 billion and deposited $1.01 billion, producing net outflows of roughly $3.64 billion. Binance said that represented 2.1% of the $171 billion in assets reported in its October 28 proof of reserves. More networks and several fiat withdrawal channels were subsequently reopened.
The recovery process remains closely tied to asset type. Centralized token issuers can freeze selected balances, while native assets such as Bitcoin cannot be remotely disabled at protocol level. The response already included stablecoin freezes linked to the Binance incident, while the FBI is asking infrastructure providers to disrupt laundering routes involving the published addresses. That creates a multilayered recovery effort combining issuer controls, exchange cooperation, transaction monitoring and law-enforcement coordination.
The FBI’s attribution also changes the investigation from an unidentified intrusion into a state-linked cybercrime case with an active laundering trail. Authorities expect stolen assets to move through DeFi and instant-swap services, making transaction screening central to containment. Binance has said users will not bear the financial losses, while withdrawal volumes were stabilizing after the initial reopening surge. The broader market fallout from the Binance breach remains visible, but operationally the key development is that services are returning while authorities pursue assets already dispersed across multiple blockchain networks and across both centralized and decentralized infrastructure globally.
