The Federal Bureau of Investigation has attributed Binance’s theft of more than $6 billion in crypto assets to North Korea, identifying the activity as TraderTraitor. The FBI said the attackers are mainly converting the stolen assets into ETH and are expected to continue laundering funds through DeFi services and instant swap platforms.
Binance had previously estimated the total impact of the incident at about $6.3 billion. After law enforcement published addresses tied to the case, Chainalysis, TRM Labs and Elliptic released additional details on attribution, fund movements and interdiction efforts.
Binance co-CEO He Yi said the exchange needs to work with U.S. companies to freeze and recover assets, adding that U.S. law enforcement had been "very efficient." She also said information released by law enforcement in cases that draw global attention is strictly verified and supported by evidence.
FBI attribution points to North Korea as investigators focus on fund commingling
The FBI notice did not lay out the full investigative process or a complete evidentiary chain behind the attribution. It said the FBI, working with the U.S. Secret Service and IRS Criminal Investigation, observed TraderTraitor actors converting stolen assets primarily into ETH. The notice also listed addresses controlled by, or closely associated with, North Korean attackers that currently hold or previously held stolen funds.
Before the FBI statement, Chainalysis had already linked the incident to TraderTraitor. The firm said its assessment was based on on-chain activity observed within hours of the attack. The strongest signal, according to Chainalysis, was that funds stolen from Binance became mixed on-chain with funds from an earlier Bitget theft, an incident that had already been attributed to North Korea-linked attackers. Chainalysis said that direct on-chain connection strengthened its view of who was behind the attack.
TRM Labs said it attributed the attack to TraderTraitor with high confidence based on on-chain and off-chain intelligence. The firm pointed to several recurring traits: small withdrawals from Tornado Cash used to fund operational wallets, preparation before the theft took place, and the collection of signatures in advance followed by coordinated execution. TRM said those features resembled patterns seen in earlier cases involving North Korea, including incidents tied to Bybit and KelpDAO.
Attackers sold tokens for ETH and used DeFi structures to keep moving funds
According to Lookonchain, by the time of its disclosure the Binance attacker had sold more than 130 tokens on EVM chains, receiving about 123,400 ETH and 1.69 million USDC, worth roughly $279 million at the time. Tokens sold included UNI, ENA, PEPE, LINK, AAVE, ONDO and WLD.
Elliptic said the attackers did more than swap tokens for ETH on decentralized exchanges. It tracked a flow in which about 59.9 million USDT was deposited into Aave as collateral and about 19,762 ETH was borrowed against it. Elliptic said Aave later froze the relevant market, but that action restricted new activity rather than amounting to a seizure of the attackers’ assets.
Chainalysis later described another method used to reduce the effect of stablecoin freezes. Using an example involving about $500,000, the firm said the attackers swapped TRX for stablecoins on Tron, deposited those stablecoins into a DeFi lending protocol, and received deposit receipt tokens representing a claim on the pool assets. Those receipt tokens were then sent to another wallet, which redeemed the stablecoins, bridged the funds out of Tron and converted them into ETH.
Chainalysis said those receipt tokens are different from the stablecoins they represent and are not subject to the same freeze controls imposed by stablecoin issuers. Whoever holds the receipt token can redeem the underlying asset. The firm said the method appeared early in this attack and had also been used by North Korean attackers in other thefts. It added that converting stablecoins into ETH does not make the funds untraceable, and investigators are still analyzing the paths in real time.
Chainalysis also described signs of automation. In a short period, it observed thousands of transactions, with stolen funds cycling through multiple addresses and at times returning to addresses used earlier. Many addresses first received exactly 1 TRX, then took in more funds and sent them onward. The firm said those repeated patterns suggest the attackers may be using software to automate transfers and allocation.
THORChain pause slowed one route while Relay still carried large transfers
Chainalysis said an Ethereum chain reorganization caused THORChain to mistakenly issue a duplicate refund to a user who had deposited 10 ETH, triggering an emergency pause. The pause affected all users, including North Korea-linked launderers. At the time of Chainalysis’ post, neither the attackers nor other users could swap through most of THORChain’s cross-chain routes. The firm said the malfunction unexpectedly slowed the laundering of a large amount of stolen Binance funds.
Separately, on-chain investigator Specter said North Korea-linked hackers moved about $38 million through the Relay Protocol bridge in seven hours and were still doing so at the time of the post. Specter said Relay had claimed to deploy a KYT, or know-your-transaction, monitoring system, yet the transfers were not stopped, raising questions about its risk controls. Specter also said it would have been difficult for the hackers to move that scale of funds through THORChain over the same period.
As funds continued to move, the FBI, USSS and IRS-CI called on THORNode operators, RPC node operators, instant swap platforms, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions involving the addresses listed in the notice or funds originating from them.
THORChain co-founder Chad Barraford responded that node operators do not possess any non-public information. He said the relevant data is public, available in real time and can be reviewed without a subpoena, adding that this is the best possible setup for investigators.
Some assets were frozen or permanently locked as Binance said it had replenished about 95%
In an update, Elliptic said it had verified about $2.85 billion in frozen or otherwise controlled assets tied to the case, mainly in USDT and USDC. Beyond issuer freezes, the Arbitrum Security Council had also taken emergency action to move related assets out of the attackers’ control. Elliptic said it had published a public list containing more than 1,000 related addresses for companies screening suspicious flows.
Newton Foundation said the attackers appear to have made an operational mistake by sending about 8 million NEWT and 17 other tokens directly to the NEWT token contract, with a combined value of about $3.5 million. The foundation said the NEWT contract itself was not attacked, but because admin rights had been renounced and upgrade functions permanently disabled, no one, including the foundation, could recover those tokens. It said the assets are permanently locked and that its findings had been shared with Binance.
Binance said it has restored withdrawals for some assets on the BTC, ETH, BSC, XRP and Base networks, covering BTC, ETH, BNB, XRP, USDT and USDC among others. Other networks and assets will be restored in phases after security checks are completed.
On replenishment, Binance said it has covered about 95% of affected assets, up from an earlier 90%. It said the top 10 tokens by exposure, including BTC, ETH, USDT and BNB, are now backed at 100% reserve sufficiency. The remaining roughly 5% consists of lower-liquidity tokens that the company is still buying, and Binance said it will bear the full financial loss caused by the theft.
As of 20:36 Beijing time on Nov. 1, withdrawals had been restored across the first batch of 15 networks and related assets. In the 9.5 hours after withdrawals resumed at 14:00 that day, the platform processed $4.649 billion in withdrawals and $1.01 billion in deposits, for net outflows of about $3.64 billion. Binance said that figure was equal to 2.1% of the $171 billion in assets under management listed in its latest proof-of-reserves report dated Oct. 28. The exchange said withdrawal volume spiked at first, then eased and stabilized, while deposits remained elevated.
Binance also said it updated its proof-of-reserves address list as a protective step after the incident, adding newly generated wallet addresses. All future withdrawals will be processed through those new addresses.
