Skip to content
Blockchain Posts

exploit

FBI, USSS and IRS-CI formally attribute Binance hack to TraderTraitor, publish address blocklist

FBI, USSS and IRS-CI formally attributed the Oct 29 Binance theft of over $6B to TraderTraitor. The notice lists over 600 ETH, under 20 BTC and one SOL address and asks THORNode and DeFi to block.

by 5 min read
exploitbinanceregulationon-chainethereum

The FBI, US Secret Service and IRS Criminal Investigation issued a joint notice on October 31, 2026 naming TraderTraitor — a subunit of Lazarus Group — as responsible for the October 29 theft of over $6 billion in crypto from Binance hot wallets. The notice, posted by FBI Cyber Branch, lists hundreds of indicator addresses and asks THORNode operators, RPC providers, instant exchanges, DeFi services and blockchain analytics firms to reject transactions tied to them. Coverage: CoinDesk, The Defiant, Crypto Briefing.

What happened

Per CoinDesk, the FBI's statement says the bureau is "releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026." The agencies refer to the activity as TraderTraitor and say they have observed the actors converting stolen assets primarily into ETH.

The notice is the first formal US government attribution for the incident. Private-sector analysts had reached the same conclusion earlier in the week: Chainalysis published its TraderTraitor attribution at 00:30 ET on October 30, citing on-chain commingling with the September Bitget theft (Chainalysis blog). TRM Labs and Elliptic reached the same conclusion separately.

The scope of what the agencies published is unusually operational:

  • Over 600 Ethereum addresses (CoinDesk's count).
  • Just under 20 Bitcoin addresses.
  • One Solana address.
  • Addresses are hosted on fbi.gov per the agencies' notice.

Mechanism — the blocklist as policy instrument

The published addresses are indicators of compromise, not freezable instruments. On Bitcoin and most EVM chains there is no network-level freeze; the request is for intermediaries to reject transactions touching those addresses at the application layer. The named categories map the attacker's expected laundering path:

  • THORNode operators — THORChain's cross-chain swap network, which the FBI cites by name. TraderTraitor has routed earlier hauls through it.
  • RPC node operators — the request implies filtering transaction broadcasts, which is technically trivial on a public RPC and politically fraught.
  • Instant exchanges — no-KYC venues like SimpleSwap, FixedFloat, eXch (now defunct).
  • DeFi services — DEX routers, bridges, lending protocols.
  • Blockchain analytics firms — flagging in commercial KYT systems.

Jonathan Levin, Chainalysis CEO, is quoted in the CoinDesk piece saying the attackers have already used "thousands of addresses" and that his firm expects the count to reach "tens of thousands over the coming weeks". Chainalysis's blog describes "novel automated laundering mechanisms" and reports that many destination addresses first received exactly 1 TRX before use — a scripted provisioning pattern.

Numbers block

- Theft date (FBI)                : 2026-10-29
- Loss figure (FBI notice)        : > $6 billion
- Chainalysis figure              : $6.4 billion
- TRM Labs figure                 : $6.36 billion
- Binance figure                  : $6.3 billion
- Addresses published (ETH)       : > 600
- Addresses published (BTC)       : < 20
- Addresses published (SOL)       : 1
- Converted into                  : primarily ETH (per FBI)
- Issuing agencies                : FBI, USSS, IRS-CI
- Issuing date                    : 2026-10-31

The FBI did not publish a dollar figure for how much of the stolen crypto is currently frozen. Stablecoin issuer freezes total roughly $2.4 billion — 1.567B USDT per Tether CEO Paolo Ardoino and about $823M USDC per Circle CEO Jeremy Allaire — with additional freezes from Ripple and World Liberty Financial. Those figures sit outside the FBI notice (see our Oct 31 coverage of the freeze response).

Impact — what the request does and doesn't do

The notice carries no statutory bite. It is a public service announcement, not an OFAC designation. US persons who happen to interact with a listed address do not inherit a sanctions nexus — that would require Treasury action, and none has been announced. What the notice does do:

  1. Shift compliance expectations. A commercial KYT provider ignoring the list after today operates on borrowed time; so does a DEX frontend or RPC that filters some chains but not these addresses.
  2. Define the laundering surface. By naming THORNode first, the agencies make the next months of enforcement attention explicit.
  3. Give downstream exchanges cover. Deposits from a listed address can be rejected without a court order, pointing to the FBI notice as the basis.

Binance has told users it will absorb all losses and remains on track to restart withdrawals Sunday, November 1 (CoinDesk, Oct 31). President Trump said Friday "we're learning about it" and that his administration would "talk to North Korea about it"; no sanctions or executive order followed.

Action checklist

  1. For DeFi protocol teams: pull the FBI address list, add it to any front-end warning layer and smart-wallet guard rails, and treat THORNode-sourced flows as elevated risk.
  2. For infrastructure operators (RPC, indexers, instant-swap venues): add the published addresses to transaction-level filtering and log attempted touches for law enforcement.
  3. For custodians and exchanges: deposit screening against the FBI list is table stakes from today.
  4. For analysts: watch for the first OFAC designation — the Treasury step that converts the PSA into a sanctions instrument — and the first civil forfeiture complaint on seized assets.

Context — the Bybit precedent

The pattern echoes February 2025: TraderTraitor drained roughly $1.4 billion from Bybit via a Safe-wallet UI compromise. The FBI issued a similar PSA days after that incident, and OFAC followed with targeted designations against mixer services downstream. The Binance notice is more operational — more addresses, cross-chain — and it names service categories (THORNode, RPC) that the Bybit notice did not. The next tells will be whether the Treasury follows the same escalation path and whether any US-domiciled DeFi protocol declines to block.

Related stories