Binance hack: FBI names North Korea and lists more than 600 addresses

The FBI has officially attributed the theft of more than six billion dollars at Binance to North Korea and published a list of addresses that held parts of the proceeds. For holders in Germany this is above all a story about money laundering, and about what happens when flagged coins eventually arrive at a regulated exchange. Your own balances at Binance are not affected by the list: the exchange says it has replaced 90 percent of the missing holdings out of corporate funds and reopened withdrawals.

What the FBI notice of October 31 says

The US federal police issued its notice on Saturday, October 31, 2026, together with the Secret Service and the tax investigators of IRS Criminal Investigation. According to several news agencies it states that North Korea is responsible for the theft of more than six billion dollars in virtual assets at the crypto exchange Binance, committed on or around October 29, 2026. The agency names the group responsible as TraderTraitor.

Two things in the notice go beyond the attribution itself. First, a list of addresses on three blockchains through which stolen funds have moved. Second, a request to a whole range of companies to block transactions with these addresses. The FBI expects the attackers to keep moving the proceeds through decentralised finance services and instant swap services.

Until that Saturday the attribution was an assessment by private analytics firms. TRM Labs and Chainalysis had traced the trail to North Korea early on, and we summarised the state of that suspicion on October 30. Since October 31 an agency that is investigating the case stands behind it.

TraderTraitor: how the FBI links the group to North Korea

TraderTraitor is the name US authorities have used since 2022 for a state-backed North Korean attack campaign against crypto companies. What characterises it is not the technical break-in but the route there: fake job offers, doctored application documents and trading software, and contacts with employees built up over months. According to the authorities, the same group is also held responsible for the Bybit theft of around 1.46 billion dollars in 2025.

The analytics firm Elliptic, which has been following the case on the blockchain since the evening of October 29, had reached the same conclusion before the FBI. The firm's reasoning rests on three observations. The stolen funds are being laundered together with the proceeds of the Bitget attack, which Elliptic also attributes to North Korea. The attackers are using the same services as in earlier TraderTraitor thefts at BigONE, WOO X and AFX. And they worked eleven blockchains in parallel in about three hours, something that in Elliptic's account only a few actors can coordinate.

One point matters for context: an attribution by an authority is not a court ruling, and it is not a sanctions decision either. An attribution of this kind states where the evidence points in the investigators' view.

More than 600 Ethereum addresses, just under 20 for Bitcoin, one for Solana

According to several trade publications, the FBI list covers more than 600 addresses on Ethereum, just under 20 addresses on Bitcoin and a single address on Solana. That distribution is no accident; it follows the composition of the proceeds.

Elliptic puts the theft at 6.43 billion dollars, Binance itself cites around 6.3 billion, TRM Labs about 6.36 billion. The range comes from the prices used at the time of valuation and from which outflows are counted as part of the attack. Elliptic, for instance, explicitly leaves out 169 million dollars that flowed out after withdrawals were halted and that the firm considers internal transfers by Binance.

In Elliptic's breakdown, 3.80 billion dollars fell on Ethereum across 186 different tokens, among them 1.9 billion USDT and 823 million USDC. On Bitcoin, 18,270 BTC worth 1.48 billion dollars went out. Over Tron, 612.7 million USDT moved, and over the XRP Ledger 233 million XRP. Solana, NEAR, Base, Optimism, Arbitrum, Avalanche and Polygon were affected as well. Four items together made up 74 percent of the theft: USDT on Ethereum, Bitcoin, USDC and USDT on Tron.

That there are more than 600 addresses on Ethereum and one on Solana therefore says less about the blockchains than about the perpetrators' technique. On Ethereum an attacker spreads proceeds in many small steps across contracts and helper addresses. A single transfer on Ethereum moved 2.53 billion dollars in value on October 29 at 20:24 UTC.

THORNodes, RPC nodes, instant swap services: who the blocking request is aimed at

The addressees of the request are unusually specific. According to CoinDesk, the FBI, the Secret Service and IRS-CI approached private companies, explicitly including operators of THORNodes and operators of RPC nodes, along with instant swap services, decentralised finance services, blockchain analytics firms and other virtual asset service providers.

An RPC node is the server through which a wallet or an app talks to a blockchain: it accepts transactions and passes them on into the network. A THORNode is a node of the THORChain protocol, through which coins can be swapped across blockchains without an exchange in between. Neither is a financial service provider in the classic sense, and both sit at a point where a transfer can in practice be refused before it reaches the network.

That is the real news in this notice. Beyond exchanges and stablecoin issuers, which can freeze balances, the authorities are turning to the technical infrastructure behind them. Anyone running an RPC endpoint is thereby performing a function that lawmakers have so far barely addressed.

A blocking request is neither a seizure nor a sanction

The most important sentence about this list concerns what it does not achieve. The notice is a request to companies, not an order, and on what has been reported so far it contains no sanctions decision by the US Treasury that would place the addresses on the SDN list, nor does it authorise anyone to return frozen balances to Binance or to customers.

That difference has practical consequences. A sanctions listing obliges every company with a US nexus to refrain from dealing with the address, and it reaches beyond US law to banks and payment providers. An FBI request, by contrast, works through compliance departments, through analytics software and through the decisions of individual operators. Whoever follows it does so voluntarily, or because their own anti-money-laundering checks require it anyway.

Returning the funds already frozen needs a separate route: seizure orders, proceedings in the home countries of the respective issuers, or civil action. This part of the case will take months.

2.85 billion dollars frozen: why stablecoins sit differently from Bitcoin

After its own review, Elliptic has verified 2.85 billion dollars as frozen or secured, which is 44 percent of the proceeds. Binance itself speaks of around three billion. The composition is striking: 94 percent of the frozen sum is stablecoins.

The reason lies in the construction. A stablecoin such as USDT or USDC is a company's promise to pay, mapped into a contract on a blockchain, and that contract has a freeze function. Tether, Circle and Ripple were therefore able to immobilise balances at specific addresses at the push of a button; the first USDT freeze ran on the very evening of the attack. At the Arbitrum protocol the Security Council stepped in as well, and at Optimism, according to reports, governance moved funds out of the attacker's reach.

Native coins do not work that way. With Bitcoin, XRP, Solana and NEAR there is no issuer who can switch off an address. On Elliptic's count, these are precisely the holdings the attacker still has: around 3.21 billion dollars, among them 519,104 ETH worth about 1.16 billion dollars and the 18,270 BTC worth about 1.41 billion dollars.

This censorship resistance is the same property that makes Bitcoin attractive to investors. In a theft it works against the injured parties. A blocklist is therefore the only tool that works at all for native coins: you cannot stop the coins, only the doors through which they want to enter the regulated financial system.

EIP-7702: the delegation with which Binance's own systems signed

The day after the attack Binance had named a compromised laptop belonging to a DevOps engineer as a possible entry point, while stating that there was no indication at that time of a private key having leaked. Elliptic's analysis suggests the attacker needed no key, but rather a function that Ethereum has only had since 2025. We wrote up the technical sequence at the hot wallet in detail on the day of the attack.

EIP-7702 allows a contract to be assigned to an ordinary account as a delegate, by signature. The account then behaves like a programmable wallet. The function is meant for convenience, for instance so that an app can cover fees or bundle several steps into one transaction. In Elliptic's account, a single transaction on October 29 at 20:20 UTC carried 50 such authorisations and thereby handed control of the Binance hot wallet labelled "Binance 14" to a sweeper contract, which then drained the balances by itself.

A sweeper contract is a program that automatically forwards incoming or existing balances to a target address. Binance chief Richard Teng said on October 30 that the attack had not been carried out by a single person. The first transfer out of Binance wallets ran on October 29 at 20:05 UTC over the XRP Ledger, according to Elliptic's timeline.

For holders, one point about this is notable: the proceeds left the exchange not because a blockchain failed, but because an approval process inside the company was bypassed. With a hardware wallet in your own hands that approval sits with you, and it sits on a device that accepts no delegation you have not confirmed on the display.

Aave, SunSwap and 546 transfers: the laundering runs automated

What the attackers have been doing since October 30 explains why a list of 600 addresses dates quickly. Elliptic has documented several routes along which freezable stablecoins are turned into coins that cannot be frozen.

434 million USDT were swapped into 160,451 ETH via decentralised exchanges and market makers, at a calculated discount of 12 to 26 percent against the market price. 59.9 million USDT went into the lending protocol Aave as collateral, against which the attackers borrowed 19,762 ETH; Aave has frozen the affected markets, and the loan is still outstanding. Over Tron, 234 million USDT were swapped on SunSwap into 638 million TRX, of which between 38 and 67 million dollars have already left the addresses Elliptic tracks. The Bitcoin holdings are running through a peel chain, in which a small part is split off a large sum at every step, spread across 19 addresses; as of Elliptic's latest reading, none of it has arrived at a service provider yet.

The pace is particularly revealing. The main Tron laundering wallet sent 546 transfers from October 30 onwards, with a median interval of 96 seconds and a longest pause of 39 minutes. Elliptic takes this for software and writes explicitly that it cannot be determined whether AI agents are involved.

Chainalysis chief Jonathan Levin told CoinDesk the attackers had already used thousands of addresses, and added that he expects that to grow into the tens of thousands over the coming weeks. Ari Redbord, chief policy officer at TRM Labs, reckons the proceeds will be split up and funnelled through smaller exchanges over months; speaking to the Australian broadcaster ABC, he called the theft itself a bank robbery, in this case at the speed of the internet. Both firms stress that the funds remain traceable in real time.

Tainted coins: when a deposit at an exchange gets stuck

The question that really touches holders in Germany in this case is this: can it happen to me that coins in my account count as tainted because one of these addresses appears somewhere in their history?

The technical term for it is tainted coins: coins whose traceable origin touches a flagged address. The analytics software exchanges use to screen deposits assigns a risk score for this, and alongside the direct sender it looks several stations back. Depending on the setting, an indirect connection across two or three intermediate steps is enough for a deposit to go into manual review.

In practice the risk for ordinary buyers is low, but it is not zero. Anyone who buys Bitcoin at a regulated platform and keeps it there has nothing to do with the history. Anyone who buys via decentralised exchanges, instant swap services or peer-to-peer trading, on the other hand, takes on the history of the coins received. An amount coming from that direction and later deposited at an exchange can be held temporarily until the origin is clarified.

Realistically it looks like this: the platform asks for proof of origin, that is, purchase receipts, account statements or transaction histories. Anyone who has those documents usually gets their balance released. Anyone who does not negotiates with a compliance department. From that mechanism follows the sober advice to archive purchase receipts, quite independently of this case: you will need the same documents for the tax office in the end.

Anti-money-laundering supervision in Germany: what MiCA platforms have to deliver

For providers operating in Germany, a denser net of obligations has applied since the MiCA regulation came fully into force than before 2025. Licensed crypto service providers are subject to the Money Laundering Act, must monitor transactions, file suspicious activity reports with the Financial Intelligence Unit and provisionally hold assets where there is reasonable suspicion.

An FBI list is not a legal act for a German platform, but it is a solid indication. As soon as a provider knows about an officially attributed address, it can no longer plead ignorance. In supervisory practice that means such lists feed into providers' screening rules within days, even without an order from Brussels or Bonn.

A second point concerns stablecoin issuers. USDC issuer Circle and USDT issuer Tether froze funds in this case before any authority called for it. Under MiCA, issuers of e-money tokens need authorisation in the EU, and their freezing practice thereby becomes part of the supervised activity. For holders that means two things: stablecoins are the part of the market where stolen goods are most likely to be recovered, and they are the same part where an outside body can technically immobilise your balance.

FBI blocklist: 600 addresses are only the start of the trail

The FBI list describes an interim state as of October 31, and Chainalysis already expects tens of thousands of addresses. Three steps are worth taking from this for your own portfolio.

1. Check where your coins sit and who is regulated there. A platform with EU authorisation is subject to anti-money-laundering supervision and to the duty to keep customer holdings segregated. Which providers can demonstrate that in Germany is set out in our overview of regulated crypto exchanges.
2. Separate long-term holdings from trading balances. What you want to hold for years does not have to sit on an exchange. The Binance case shows that even the largest provider is a target; that Binance is covering the damage out of corporate funds was a company decision and not a customer entitlement. Our overview of software wallets compares the alternatives.
3. Archive purchase receipts for every position. Proof of origin is the only remedy against a held deposit, and those are the same documents you need when switching providers. Where to buy in Germany and at what cost is shown by our crypto exchange comparison.

The most important question stays open: whether the request becomes a sanctions listing. If the US Treasury puts the addresses on the SDN list, the situation changes for every company with a US nexus from voluntary to mandatory. Until then every operator decides for itself, and that is precisely what makes the success of this list hard to measure.

The sources for this article: the on-chain analysis by Elliptic with the breakdown per blockchain and the timeline of the attack, and the report by the Australian broadcaster ABC on the FBI notice with the statements from TRM Labs. The FBI notice itself is published via the agency's website; fbi.gov rejects automated requests.

(As of November 1, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)