FBI blames N. Korea’s TraderTraitor for Binance theft, urges crypto industry to block transactions

The FBI and U.S. Secret Service alleged this weekend that North Korean hackers were responsible for stealing more than $6.3 billion from cryptocurrency platform Binance last week. 

In messages on Saturday and Sunday, both federal law enforcement agencies blamed North Korea’s TraderTraitor hacking group for the theft and urged the cryptocurrency industry to stop the funds from being laundered. 

The hackers behind the theft have spent days moving and swapping the funds, conducting thousands of seemingly automated transactions to obfuscate the source of the cryptocurrency and exchange them for coins that can be cashed out into fiat currency. 

The FBI, Secret Service and IRS specifically called out exchanges, decentralized finance companies and several other technical operators within the cryptocurrency industry — urging them to “block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.”

The FBI provided a list of cryptocurrency addresses used by TraderTraitor to store the stolen funds. 

“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH),” the FBI said. “It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.”

The Secret Service claimed that within minutes of the attack, they worked with cryptocurrency industry players and the Justice Department to “identify and freeze a significant portion of stolen cryptocurrency.” 

Blockchain security experts said about $3 billion has been frozen so far but multiple platforms argued that they are decentralized and cannot stop anyone from making transactions.

The attack on Binance — the world’s biggest cryptocurrency exchange — forced the platform to shut down for several days as it used its reserve funds to replace the stolen coins. 

After initially claiming that a compromised laptop owned by an engineer was the source of the theft, the company said further investigations have uncovered “additional points of breach.”

“This was a complex attack. The attacker also used a self-destruct mechanism that destroyed tooling and traces as they went, making it more difficult for us to trace and investigate,” CEO Richard Teng said on Saturday. 

The company reopened its site for deposits and withdrawals on Sunday morning. Binance’s controversial founder and former CEO, Changpeng Zhao, said U.S. law enforcement agencies helped to track and freeze the stolen funds, crediting them for making sure the price of Bitcoin did not drop significantly. 

‘Chinese launderers at work’

Blockchain security firms Elliptic and Chainalysis warned that the North Korean group behind the attack was using automation to launder the stolen funds at speeds that made it difficult for defenders to monitor or freeze them. Elliptic said the hackers have used about 12,000 wallets across 11 blockchains — conducting about 40,000 transactions while shuffling funds to a new wallet every 25 seconds.

Elliptic co-founder Tom Robinson said the laundering was “on autopilot” and added that it was likely automated with human oversight as opposed to being done with an AI agent.

“The timing looks programmed. For anyone screening, a wallet that clears today can receive funds from this cluster hours later. One-off checks and static lists won’t catch it,” the blockchain security firm said. 

Pierce Vaughn, senior investigator at Chainalysis, told Recorded Future News it was clear the laundering was planned ahead so DeFi platforms and other tools could be leveraged faster with intent. 

“We find the automations TraderTraitor is using has procedures already in place so that when a wallet is funded or liquidity is available, the next phase of laundering is executed,” Vaughn said. 

North Korea has extensive experience at this point with laundering funds stolen from cryptocurrency platforms after nearly a decade conducting attacks. 

Michael Barnhart, a nation-state threat researcher at DTEX who has spent years tracking North Korean cybercrime campaigns, told Recorded Future News that TraderTraitor's modus operandi is to immediately offload stolen funds to Chinese money launderers for a lump sum or percentage. 

“Once the money moves, the risk of freezes or tracking falls entirely on the Chinese criminal syndicates, not North Korea. In fact, unlike other [North Korean hacking] groups like AppleJuice or CryptoCore, TraderTraitor is unique in how rapidly they hand off funds to these outside laundering networks,” he said.

“Consequently, on-chain observers who think North Korea is still actively moving the assets are actually just watching Chinese launderers at work.”

Former FBI deputy director Cynthia Kaiser said some of the most complicated charts she ever received were “from North Korea money movements after crypto heists.” 

“In this case, it sounds like about half the money stolen has been moved so many times that it will make recovering more funds incredibly difficult. And that’s a problem for all of us, because North Korea uses stolen money to fund its weapons of mass destruction program,” she explained. 

Chainalysis published eye-popping statistics this weekend about North Korea’s prolific hacking campaigns against cryptocurrency firms.

The country’s government is responsible for almost 90% of crypto hack losses in 2026, with the average reported loss per attack rising from $50 million in 2021 to $185 million in 2026. 

From 2021 through 2026, suspected North Korean hacks accounted for more than $13 billion in losses. 

TraderTraitor has been spotlighted repeatedly by the FBI and experts as the perpetrators of high-profile cryptocurrency thefts. According to the FBI, the group was responsible for stealing $1.4 billion from Dubai-based crypto platform Bybit last year and nearly $300 million from another crypto company called KelpDAO in April 2026. 

Last month, crypto platform Bitget said North Korean hackers stole more than $387 million in a cyberattack. One piece of evidence tying the group to the Binance incident was that funds from the platform were being commingled with cryptocurrency stolen from Bitget and other previous victims.