FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist

What it is

On 31 October 2026 the FBI, with the Secret Service and IRS-CI, attributed the 29 October theft from Binance hot wallets to North Korea's TraderTraitor group. Binance puts the loss at about $6.3 billion. Elliptic counts $6.43 billion across 11 blockchains. The FBI says the same group took $1.5 billion from Bybit in February 2025. Hackers moved most of the funds out within about 20 minutes.

How it works

The FBI says TraderTraitor is converting stolen assets mainly into ETH, and expects DeFi and instant swap services to be used for further laundering stages.

Elliptic and Chainalysis both see automation:

• The main Tron distribution wallet paid out hourly for more than a day, around the clock.
• When a cross-chain bridge refused deposits, the system sent the money to the same destination through freshly created wallets.
• By late 31 October, about $196 million had moved from that wallet to roughly 200 others. THORChain was the largest exit at about $31 million.
• Chainalysis saw thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.

Elliptic says on-chain data cannot show whether this is AI agents or conventional scripts. It expects laundering to take months, as with Bybit.

On Binance's side, co-CEO Richard Teng said the first finding of a compromised laptop (a DevOps engineer's) was incomplete, and later work found additional breach points. Teng said the attack "was not carried out by one person" and that a self-destruct mechanism wiped the attacker's tooling and evidence. Teng also said the attacker's use of Ethereum's EIP-7702 delegation "did not pass through our normal approval controls."

Preconditions / Affected

The FBI's request covers THORChain node operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms. The alert lists 608 Ethereum, 19 Bitcoin and one Solana address that hold or previously held proceeds.

Elliptic reports $2.85 billion frozen or seized. About $3.25 billion remains with the attacker in assets no issuer can freeze, across more than 800 addresses: roughly 584,000 ETH, 18,327 BTC and 233 million XRP.

What to do

The page gives one explicit action: refuse transactions linked to the FBI-listed addresses. The page does not reproduce the list, so it must come from the FBI alert itself.

The Elliptic and Chainalysis observations suggest screening signals beyond a static list, though the page does not frame them as detection rules:

• Fresh wallets that reappear after a bridge or service refuses deposits.
• Hourly payout cadence.
• New addresses whose first transfer is exactly 1 TRX.

Because funds are being rerouted through new addresses, a static list will lag.

Caveats

Binance has not detailed the additional breach points and has promised a technical post-mortem once the facts are verified. How EIP-7702 delegation was abused, and what approval controls it bypassed, is therefore unknown. Elliptic's figures are its own and differ from Binance's estimate.

Binance began phased withdrawals on 1 November, starting with Bitcoin. It reports about 95% of the stolen amount replaced from company funds, with the remaining less liquid tokens being bought on the market and over the counter. Users are not meant to bear the loss.