FBI attributes record Binance exploit to North Korea as laundering accelerates

The Federal Bureau of Investigation attributed a massive exploit of cryptocurrency exchange Binance to North Korean cyber actors operating under the name TraderTraitor. Outlets differed on the exact stolen sum, with CryptoSlate and The Defiant citing more than 6 billion dollars, while Cointelegraph and NBC News reported approximately 6.3 billion dollars stolen on October 29. As FTMQ Crypto reported earlier, attackers targeted the exchange on Thursday, prompting stablecoin issuers to freeze billions in stolen assets. [2][4][5][6][15]

In an October 31 security alert, the law enforcement agency confirmed that the attackers primarily converted stolen funds into Ether, according to CryptoSlate and Cointelegraph. CryptoTicker.io reported that the agency listed more than 600 cryptocurrency addresses associated with the illicit activity. The FBI explicitly urged private sector entities, including RPC node operators and THORNode operators, to assist in blocking the laundering of stolen digital assets, according to Cointelegraph and The Defiant. [2][3][4][7]

The Block reported that hackers moved roughly 242 million dollars in stolen Binance loot via the Tron network. Cross-chain bridges Relay, THORChain, Chainflip, and Symbiosis routed about 140 million dollars of these stolen funds off Tron, with Relay handling the largest portion at 48 million dollars, according to The Block. Following the FBI appeal, a THORChain co-founder cited public data while noting that protocol-level controls allow broad trading halts that also disrupt legitimate users, according to The Defiant. [1][7][8][9]

Binance was founded in July 2017 by Changpeng Zhao as a fast platform prioritizing user liquidity. The recent security breach marks one of the largest cryptocurrency thefts in history, heavily involving decentralized finance protocols and instant swap services to obscure transaction trails. According to The Defiant, Binance maintained November 1 as its target date to resume user withdrawals following the attack. [2][4][6][13]