The FBI has attributed the theft of more than $6bn from cryptocurrency exchange Binance to North Korea, identifying the TraderTraitor group as the actor behind the breach. In an October 31 statement released alongside the US Secret Service and IRS Criminal Investigation (IRS-CI), the Bureau said the stolen assets are being converted primarily into Ethereum, with further laundering through decentralized finance (DeFi) products and instant swap services expected to follow. Binance has said it will absorb the cost of the incident and that customer funds are not at risk, while its investigation into how the breach occurred is still ongoing.

Attribution and the conversion trail

The Bureau's statement was brief but specific about the money movement. According to the FBI, TraderTraitor — also tracked as Jade Sleet, UNC4899 and Slow Pisces — is converting the proceeds mostly into ETH, a common intermediate step before assets are pushed through DeFi protocols and instant exchange services in preparation for later laundering stages.

The Bureau and its partners did not limit their request to exchanges alone. They called on THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions involving, or derived from, the addresses TraderTraitor is using to wash the funds. That wording matters: the request covers downstream, derived value as well as direct transfers from the original wallets, which is what makes cross-chain hops and swaps an attribution problem rather than a simple blocklist lookup.

What Elliptic says is still mobile

Blockchain analytics firm Elliptic estimates that roughly $2.9bn of the stolen funds has already been frozen or seized. That leaves almost $3.3bn beyond the reach of asset issuers — a gap that reflects which assets have a party able to freeze balances and which do not.

Elliptic's breakdown puts approximately $3.25bn in assets that cannot be frozen by an issuer, distributed across more than 800 addresses. The composition:

  • Roughly 584,000 ETH, valued at about $1.32bn
  • 18,327 BTC, valued at about $1.42bn
  • 233 million XRP

The ETH figure is not simply native holdings. Per Elliptic, it includes TRX that was laundered through bridges, arriving on Ethereum and then split across hundreds of fresh wallets. Almost all of the stolen TRX has now been laundered, according to the firm. By contrast, the XRP, SOL and NEAR — collectively worth around $439m — have not moved at all since the theft.

Binance's account of the breach

Binance has committed to covering the incident's costs, so customer balances are unaffected. The cause, however, remains under investigation.

The exchange initially pointed to a compromised DevOps laptop as a possible entry point, then later said it had "uncovered additional points of breach" and characterised the operation as a "complex attack." Elliptic's assessment adds two details that explain why forensics have been slow: more than one individual took part, and the intrusion used a "self-destruct mechanism that destroyed tooling and traces as it ran."

That combination — multiple operators plus tooling designed to erase itself — is what turns a straightforward incident-response timeline into a reconstruction exercise built from indirect evidence: endpoint remnants, network logs, wallet clustering and timing correlations rather than intact malware.

TraderTraitor's track record

The group is linked to the Lazarus Group, APT 38 and AppleJeus, and has been blamed for a series of crypto thefts:

  • DMM — $308m
  • Alphapo — $60m
  • CoinsPaid — $37m
  • Atomic Wallet — $100m
  • Bybit — $1.5bn, the previous record for the largest crypto breach

Technical background

The following is general context on how this class of theft is monetised; it is not a description of specific tooling or infrastructure used in this incident.

Large crypto thefts are rarely cashed out directly. The value is layered across chains and asset types so that no single freeze, seizure or exchange blocklist captures it.

Chain-hopping through bridges. An asset stolen on one chain is swapped for a bridged representation and redeemed on another. The source material describes exactly this pattern with TRX moved through bridges to Ethereum, where the resulting ETH is dispersed into hundreds of new wallets. Each hop breaks the naive assumption that "stolen funds live at address X."

Instant swaps and DeFi. Instant exchangers let a holder trade one asset for another with minimal identity friction, and DeFi pools provide liquidity without a custodial intermediary that could freeze an account. This is why the FBI's request extended to DeFi services and swap providers — they sit at the chokepoints where tainted value changes form.

Address dispersion. Splitting balances across more than 800 addresses serves two purposes: it keeps individual amounts below automated alerting thresholds, and it forces investigators to prove common control across a large cluster rather than tracing one linear flow.

Issuer freeze limits. Freezing works where an asset has an issuer able to act on balances. It does not work for assets held natively outside any such control, which is why a substantial share of the total can sit in known addresses yet remain unseizable.

A generic illustration of the screening decision that exchanges and node operators are being asked to make:


# Illustrative only - generic screening logic, not tied to this incident
FOR each outbound withdrawal:
    IF destination.address IN provider_denylist
       OR destination.address IN tainted_cluster(address_graph)
    THEN hold, escalate to compliance, do not broadcast

Detection and mitigation

The concrete asks in the Bureau's statement map to a short list of operational controls:

  • Node and relayer operators (THORNode, RPC): apply denylists at the transaction relay layer so that tainted transfers are not propagated, not merely flagged after confirmation.
  • Instant exchanges and DeFi services: screen both the sending address and the provenance of deposited value, since derived assets will not match a raw address list.
  • Analytics and VASP teams: cluster the dispersed wallets rather than treating the 800-plus addresses as independent entities, and treat bridge redemptions as high-risk events.
  • All covered entities: block transactions that are derived from the laundering addresses, not just direct transfers, as the FBI explicitly requested.

What remains open

Two questions are unresolved in the public account. First, the actual root cause at Binance: the DevOps laptop explanation has been supplemented, not replaced, and the exchange has not published a final determination. Second, the disposition of the roughly $3.25bn that Elliptic describes as unfreezable — value sitting in ETH, BTC and XRP across a wide address set, with the XRP, SOL and NEAR allocation still stationary since the theft.

For defenders, the practical lesson is structural: freezing depends on the asset, seizing depends on jurisdiction, and attribution depends on clustering. An operation that spreads value across all three axes is designed to outlast any single response.