FBI names North Korea's TraderTraitor in the $6 billion Binance theft
Serguey Asael Shinder1 min readThe FBI published an alert on 31 October stating that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about 29 October. The bureau attributes the operation to the activity cluster it calls TraderTraitor.
Working with the US Secret Service and IRS Criminal Investigation, the FBI says it has observed the actors converting stolen assets primarily into ether, and expects them to launder the funds further through DeFi and instant swap services. The alert is addressed to the private sector by name: THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers are urged to block transactions with, or derived from, the addresses the actors are using.
The list that follows covers addresses that are holding or have held assets from the theft and are operated by or closely connected to TraderTraitor actors: 608 Ethereum addresses, a shorter set of bitcoin addresses and one Solana address. Anyone with information is asked to contact a local FBI field office or the Internet Crime Complaint Center at ic3.gov.
What it means
An attribution of this kind does not freeze anything by itself; what it does is put named infrastructure operators on notice in writing. A swap service or RPC provider that keeps routing these addresses after 31 October can no longer say it did not know. That is why the alert lists THORNode operators first: cross-chain swap routes are where a laundering chain of this size has to pass, and they are now being asked publicly to close.