FBI Attributes $6 Billion Binance Heist to North Korean Hackers

The FBI has officially attributed the record-breaking $6 billion Binance cryptocurrency heist to the North Korean state-sponsored hacking group TraderTraitor. Law enforcement agencies have identified hundreds of digital addresses used to move and launder the stolen funds.

Working alongside the US Secret Service and IRS Criminal Investigation (IRS-CI), the FBI released its attribution on 31 October, two days after the theft. The agency has flagged 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address that currently hold or previously held proceeds from the heist.

The attack, which took place on 29 October, saw hackers drain Binance hot wallets across multiple blockchains in approximately 20 minutes. Binance has estimated the total impact at roughly $6.3 billion, marking the largest cryptocurrency theft in history.

Automated Laundering Patterns Detected

Blockchain intelligence firms, including Elliptic, have observed that the laundering process appears to be highly automated. Unlike previous state-sponsored attacks that followed human working patterns, the movement of the Binance funds is being driven by automated systems that operate continuously.

Elliptic reported that the primary wallet distributing funds on the Tron network continued to make payments hourly for more than a day. When cross-chain bridges refused deposits, the automated system rerouted funds to the same destinations through newly created wallets. The firm noted that while the exact mechanism is unclear, the pattern could rely on either conventional scripts or AI agents.

The FBI has called on THORChain node operators, RPC node operators, instant exchanges, and decentralised finance (DeFi) services to refuse any transactions linked to the flagged addresses to prevent further laundering.

Complex Breach Bypassed Controls

Binance co-CEO Richard Teng stated that the incident was a sophisticated operation that involved multiple points of breach. While initial investigations suggested a compromised DevOps engineer’s laptop may have been the entry point, subsequent findings revealed a more complex attack structure.

Teng noted that the attackers utilised Ethereum’s EIP-7702 delegation feature, which allowed them to bypass the exchange’s normal approval controls. Furthermore, the threat actors deployed a self-destruct mechanism to wipe their tooling and evidence, complicating the ongoing forensic investigation.

Binance has begun a phased resumption of withdrawals as of 1 November, starting with the Bitcoin network. The exchange has committed to absorbing the financial impact of the theft, stating that 95% of the stolen amount has already been replaced using company funds.