FBI Attributes Binance Attack to North Korean Hackers, Automated Money Laundering Underway
Original | Odaily (@OdailyChina)
Author | Asher (@Asher_0210)
This morning, a notice released by the U.S. Federal Bureau of Investigation (FBI) indicated that North Korea is responsible for the theft of over $6 billion in virtual assets from Binance, and referred to the related malicious cyber activity as "TraderTraitor." This group was also identified by the FBI as the perpetrator behind last year's approximately $1.5 billion theft from Bybit.
Just yesterday, when Trump was asked whether the attack was carried out by North Korea, he said, "We don't know, we're investigating." Now that the FBI has officially announced the attribution, the investigation into the largest theft in crypto industry history has made new progress.
FBI Publishes Involved Addresses, Calls on Industry to Help Intercept Funds
Along with identifying the attackers, the FBI also disclosed the movement of the stolen funds. The FBI stated that it, along with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation division (IRS-CI), has observed that the attackers are primarily converting the stolen assets into ETH, and expects they will continue to launder money through DeFi and instant exchange services in preparation for further fund transfers.
To prevent the illicit funds from continuing to circulate, the FBI published the relevant addresses (address link: https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack), and called on THORChain node operators, RPC node operators, instant exchange platforms, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions associated with these addresses and their derivative funds. Even if the funds have already been transferred to new wallets, as long as they can be traced back to the involved addresses, they fall within the scope of the requested interception. The FBI also invited individuals or organizations with information to provide tips to their local FBI office or the Internet Crime Complaint Center (IC3).
While law enforcement seeks industry assistance, the attackers continue to accelerate the movement of stolen funds. On-chain monitoring shows that some funds are repeatedly circulating among multiple new and old wallets, and are gradually entering exchange and cross-chain services.
31 Consecutive Hours of Fund Transfers, Hackers Apparently Launching Automated Money Laundering
Yesterday, the hackers continued to split, cycle back, and redistribute the stolen funds across multiple wallets. According to Onchain Lens monitoring, the attackers transferred 120 million TRX, worth approximately $38.78 million at the time of monitoring, and then further dispersed it to multiple target addresses. After passing through multiple wallets, some funds returned to previously used addresses before moving to new wallets, making the tracking path more complex.
Elliptic's monitoring update yesterday showed that the main distribution wallet on the Tron network had sent approximately $93.5 million to about 150 wallets, while continuing to receive large replenishments of funds. The transfer speed increased further overnight, reaching approximately $3 million to $7 million per hour.
These transfers exhibit clear automated characteristics. The main distribution wallet had funds going out every hour for 31 consecutive hours, with the longest pause being only 46 minutes; receiving wallets typically forwarded the funds within about two minutes. Based on this, Elliptic judged that the operations were very likely software-driven, continuing to run overnight.
The dispersed funds are flowing into exchange and cross-chain services. As of 16:11 yesterday, Elliptic had tracked approximately $25 million flowing into THORChain, with another approximately $5.3 million and $1.8 million flowing to SunSwap and Bitget Swap respectively. Fund transfers have extended from repeated circulation between wallets to various exchange and cross-chain channels.
90% of Assets Replenished, Binance Allocates Half of SAFU Funds
While the hackers continue to move the stolen funds, Binance is also purchasing tokens to fill the asset gap. According to the latest official announcement, approximately 90% of the affected assets have been replenished, higher than the previously disclosed approximately 80%. BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC have restored full reserve backing, with the remaining approximately 10% mainly involving lower-liquidity tokens that still need to be purchased through market and over-the-counter channels.
The replenishment funds came from the company's own capital, part of the SAFU fund, and part of the contract insurance fund. This morning, Binance co-CEO Yi He further stated that 50% of the funds in the SAFU fund address will be allocated to cover this loss, with the other half retained. On-chain information shows that the address has transferred out a total of 7,500 BTC in three transactions, leaving 7,500 BTC remaining, worth approximately $580 million at the time of reporting.
As replenishment progresses, users' next concern is whether reserves can be verified and when withdrawals will resume. Binance stated that it has completed the proof-of-reserves snapshot as of 8:00 AM Beijing time on October 31, with the full zero-knowledge proof expected to be generated on November 3. Additionally, withdrawal services are still targeted to resume today, with specific arrangements to be further announced.
The FBI's attribution provides direction for accountability, but the stolen funds are still circulating, and recovering the assets will take time. For Binance, the next test is to complete the remaining replenishment, restore withdrawals, and publish a full security review. Replenishing assets is only the first step; ensuring users can deposit and withdraw with confidence is the focus of what comes next in this crisis.
