FBI Links 628 Crypto Wallets to North Korea's Binance Hack

The Federal Bureau of Investigation has identified 628 cryptocurrency wallet addresses linked to a $6.3 billion breach at Binance, attributing the attack to North Korea’s TraderTraitor cybercriminal group. The agency disclosed the information on October 31, 2026, stating the theft occurred between October 28 and 30 of that year.

Breach Details and Investigation

The breach involved the unauthorized extraction of funds through a compromised DevOps engineer’s laptop, according to Binance’s internal investigation. Investigators from the FBI, U.S. Secret Service, and IRS Criminal Investigation reported that stolen assets were primarily converted into Ethereum, with expectations of further laundering via decentralized finance platforms and instant cryptocurrency exchange services.

Law Enforcement Actions

The agencies have urged cryptocurrency service providers, including THORNode operators, RPC node operators, and blockchain analytics firms, to block transactions associated with the identified addresses. This measure aims to disrupt the movement of illicit funds as attackers attempt to restructure or redistribute them.

Binance’s Response

Binance confirmed the breach on October 29, 2026, estimating the stolen amount at $6.3 billion. The exchange reported that approximately $3 billion in assets had been frozen through collaboration with law enforcement, token issuers, and industry partners. Binance emphasized that frozen funds do not constitute recovered assets but represent efforts to prevent further loss.

Technical Findings

The company’s investigation revealed that the breach originated from a compromised DevOps engineer’s device, which allowed an attacker to access a service container and execute unauthorized withdrawal transactions. No evidence of wallet private key exposure was found, though additional breach vectors were identified without public disclosure.

FBI’s Disclosure and Call for Assistance

The FBI released a list of 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address tied to the theft. These addresses are reportedly controlled by or closely associated with TraderTraitor actors. The agency has requested individuals with relevant information to contact FBI field offices or submit reports through the Internet Crime Complaint Center.

Implications and Future Steps

The disclosure does not include updated figures on frozen or recovered assets. The breach highlights the growing sophistication of state-sponsored cybercriminal operations targeting cryptocurrency infrastructure. Binance has pledged to cover all losses and plans to publish a detailed technical report following the completion of its internal investigation.

The FBI’s attribution of the attack to North Korea underscores the increasing intersection of cybercrime and geopolitical threats in the digital asset ecosystem.