CoinDesk
The FBI confirmed North Korea’s TraderTraitor group was behind the theft of more than $6 billion from Binance and urged crypto firms to block transactions tied to hundreds of identified addresses. The notice listed more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address. Binance said it had replenished 90% of the stolen cryptocurrency and planned to resume customer withdrawals on Sunday.
Why it matters
The FBI’s request reaches beyond centralized exchanges. It names THORNode and RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset providers as entities that should block transactions from addresses used by TraderTraitor to launder the funds.
The listed addresses cover only part of a widening network. Chainalysis CEO Jonathan Levin said the attackers had already used thousands of addresses and could use tens of thousands in the coming weeks as funds move through bridges, instant exchanges and swappers. Chainalysis also described automated laundering mechanisms designed to obscure the trail by circulating funds among addresses.
Market impact
Stablecoin issuers had frozen more than $2.4 billion of the stolen funds, but the attackers continued laundering much of the remainder. The mix of address blocking and asset freezes may constrain routes used to move the proceeds, while the expanding network raises the screening burden for services handling BTC, ETH and SOL transactions.
The FBI identified TraderTraitor as a North Korean hacking group; Chainalysis expects laundering activity to spread across a broader set of services. The case puts pressure on crypto infrastructure providers to respond quickly to new addresses as investigators track the stolen funds.
Frequently asked questions
-
Which addresses did the FBI identify in connection with the Binance theft?
The FBI listed more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address tied to funds from the hack.
-
Which crypto services did the FBI urge to block transactions?
The request names THORNode and RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset providers.
-
How many addresses could the attackers use for laundering?
Chainalysis said the attackers had already used thousands of addresses and expects that number to reach tens of thousands in the coming weeks.
-
How much of the stolen funds had stablecoin issuers frozen?
Stablecoin issuers had frozen more than $2.4 billion of the stolen funds, while the attackers continued laundering much of the remainder.
-
What did Binance say about replacing funds and customer withdrawals?
Binance said it had replenished 90% of the stolen cryptocurrency and planned to resume customer withdrawals on Sunday.
Altcoin Daily
WatcherGuru
WuBlockchain
CoinTelegraph