Overview
- The theft of about $6.3 billion from Binance on Oct. 29, which the FBI says was carried out by the North Korea-linked TraderTraitor cluster, prompted the agency to publish hacker wallet addresses for firms to block.
- Binance has begun a phased reopening of withdrawals and says it has recovered roughly 90% of the stolen assets by repurchasing equivalent tokens from the market.
- Investigators say the attackers relied on social engineering and third-party compromises of employee and contractor machines rather than a direct break‑in to exchange vaults.
- The FBI reported the hackers converting funds into Ether and using decentralized finance services and instant swaps to launder assets, and it urged platforms and blockchain analysts to block about 500 Ethereum addresses tied to the operation.
- Security firms and analysts point to an escalation in scale since 2022, with TraderTraitor linked to previous billion‑dollar thefts, and officials warn that recovered evidence could clarify how stolen crypto is routed to support North Korea's sanctioned activities.