CryptoSlate
North Korea’s Kim Yo Jong has denied responsibility for the theft of more than $6 billion from Binance wallets, calling US allegations “absurd rhetoric,” Reuters reported on Nov. 2, citing state news agency KCNA. The FBI attributed the Oct. 29 theft to its TraderTraitor operation and urged crypto services to block transactions tied to listed wallets and funds derived from them.
Blockchain intelligence firm TRM Labs estimated that approximately $6 billion left Binance wallets across 10 blockchains. Most of the transfers occurred in about 20 minutes beginning at 20:05 UTC on Oct. 29. TRM attributed the attack to TraderTraitor with high confidence, citing on-chain and off-chain intelligence.
Why it matters
The FBI said investigators observed the actors converting stolen assets primarily into ether and expected further laundering through DeFi and instant-swap services. Its alert asks not only exchanges but also blockchain infrastructure operators, DeFi services and analytics firms to block transactions involving the identified addresses and derived funds.
TRM assessed that valid signed transfers across multiple blockchains pointed to a compromise of Binance’s hot-wallet signing infrastructure, the systems used to authorize outgoing transactions. That remains the firm’s assessment, rather than a confirmed account of how the breach occurred.
Market impact
The FBI named THORNode operators, RPC node operators and instant exchanges among the services it wants to act on. The scope of the request highlights how tracing and disrupting a large crypto theft can depend on cooperation across exchanges, DeFi and infrastructure providers. The public dispute over attribution adds uncertainty, while the FBI’s blocking appeal puts the focus on whether services can interrupt the movement of funds.
Frequently asked questions
-
How much was taken from Binance wallets, and across how many blockchains?
TRM Labs estimated that approximately $6 billion left Binance wallets across 10 blockchains.
-
How quickly did most of the transfers occur?
TRM said most funds moved in about 20 minutes, beginning at 20:05 UTC on Oct. 29.
-
What does the FBI say happened to the stolen assets?
Investigators observed the actors converting the assets primarily into ether. The FBI expected further laundering through DeFi and instant-swap services.
-
Which crypto services did the FBI ask to block transactions?
The alert addressed exchanges, DeFi services, analytics firms, THORNode and RPC node operators, and instant exchanges.
-
What is TRM Labs’ assessment of how the theft was enabled?
TRM said valid signed transfers across multiple blockchains pointed to a compromise of Binance’s hot-wallet signing infrastructure. It is the firm’s assessment, not a confirmed explanation.
CoinDesk
WuBlockchain
TheBlock
WatcherGuru
Lookonchain