Artificial Intelligence

FBI Flags Over 600 Addresses Tied to North Korea Binance Heist

Federal law enforcement agencies have officially attributed the historic Binance cryptocurrency theft to North Korea's TraderTraitor group, flagging hundreds of wallets as the stolen funds undergo automated laundering.

Radwan AbdulhadiEditor and technology writer

Published: November 2, 2026 · Updated: November 2, 2026 · 4 min read

FBI Flags Over 600 Addresses Tied to North Korea Binance Heist — Image: SecurityWeek

FBI Attribution and Flagged Addresses

The FBI has officially pinned the record-breaking cryptocurrency heist on North Korean state-sponsored actors, releasing an official alert that identifies hundreds of crypto wallets tied to the stolen funds. According to official findings, the cyberattack was conducted on October 29, when hackers rapidly emptied Binance hot wallets across multiple blockchains within roughly 20 minutes. Binance estimates the total financial impact at roughly $6.3 billion, making it the largest crypto theft on record.

Within hours of the incident, blockchain intelligence firms such as TRM Labs and Chainalysis connected the breach to the notorious North Korean group TraderTraitor. Following its own analysis, the FBI released an official attribution on October 31, detailing how the threat actors are handling the pilfered assets.

The alert issued by the FBI specifically names 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address that currently hold or previously held proceeds from the theft. Working alongside the United States Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI) division, the FBI has called on decentralized finance (DeFi) services, instant exchanges, THORChain node operators, RPC node operators, and blockchain analytics firms to refuse any transactions linked to these specific addresses.

Laundering Patterns Indicate Automation

Blockchain intelligence firms are closely tracking how the stolen capital is being shifted across the digital asset ecosystem. Blockchain analytics platform Elliptic puts the total theft figure at $6.43 billion distributed across 11 different blockchains. Out of this total amount, Elliptic has confirmed that approximately $2.85 billion has already been frozen or seized directly on-chain.

Despite these enforcement efforts, Elliptic reports that the attacker currently retains control over roughly $3.25 billion in unfreezable assets spread across more than 800 separate addresses. This vast sum includes approximately 584,000 Ethereum units, 18,327 Bitcoin units, and 233 million XRP tokens.

Investigators have highlighted distinct operational differences between past heists and the current Binance situation. While previous incidents like the $1.5 billion Bybit hack in February 2025 featured laundering habits aligning with human working patterns, the Binance funds are being moved continuously by automated mechanisms.

According to Elliptic, the main wallet distributing funds on the Tron network continued executing hourly payouts around the clock for over a day. When cross-chain bridges rejected deposits, the system autonomously rerouted the money to identical destinations via newly created wallets. Chainalysis similarly documented laundering patterns indicating automation, pointing to thousands of rapid transactions and numerous fresh addresses initialized with precise 1 TRX transfers.

Binance Investigation and Evolving Findings

In the immediate aftermath of the security breach, Binance suggested that the intrusion might have originated from a DevOps engineer's compromised laptop computer. However, subsequent internal analysis has revealed a much more sophisticated attack vector.

Binance co-CEO Richard Teng addressed the unfolding details in a public statement, noting that the investigation uncovered multiple additional points of breach. Teng characterized the breach as a complex multi-person operation rather than an isolated security failure.

Furthermore, the attackers deployed a specialized self-destruct mechanism designed to wipe their operational tooling and forensic evidence, significantly complicating the ongoing technical investigation. Binance also reported that the perpetrator leveraged Ethereum's EIP-7702 delegation feature in a manner that managed to bypass standard internal approval controls.

Phased Resumption of User Withdrawals

Despite the severe financial disruption, Binance initiated a phased resumption of platform withdrawals starting on November 1, prioritizing the Bitcoin network first. By mid-morning on Sunday, the exchange reported processing approximately $4.6 billion in customer withdrawals alongside $1 billion in incoming deposits.

The cryptocurrency exchange confirmed that approximately 95 percent of the total stolen amount has already been replaced using company reserves. To cover remaining obligations, Binance announced it is actively acquiring less liquid tokens directly on the open market and through private over-the-counter channels.

Management reiterated its dedication to safeguarding customer deposits throughout the crisis. According to Richard Teng, the exchange remains committed to absorbing the entire financial impact of the hack internally so that ordinary users do not suffer losses.

Broader Threat Context and Industry Response

The FBI's urgent warning emphasizes the ongoing cyber threat posed by state-sponsored actors targeting the global cryptocurrency ecosystem. Federal agencies continue to coordinate closely with blockchain analytics firms and decentralized exchange operators to track down illicit fund movements and intercept fragmented laundering attempts.

As cybersecurity researchers continue to analyze digital intrusions across the financial sector, recent reports underscore the diverse threat landscape facing blockchain platforms and traders alike. Industry observers remain vigilant as investigations into major cryptocurrency heists unfold across multiple jurisdictions.