Overview
- The theft on Oct. 29 drained roughly $6.3 billion from Binance hot wallets in about 20 minutes and triggered an emergency tracing and freeze effort.
- The FBI on Oct. 31 named a DPRK‑linked unit it calls TraderTraitor, shared lists of suspect wallet addresses, and asked exchanges and node operators to block those funds.
- Blockchain analytics firms say attackers used about 12,000 wallets across roughly 11 blockchains and ran more than 40,000 transactions in automated laundering that moved funds through Tron, Ethereum and cross‑chain bridges.
- Investigators and partners have frozen or seized about $2.8–$2.9 billion, Binance says it has replaced roughly 90–95% of affected assets from company reserves, and withdrawals are being resumed in phases.
- Pyongyang, through Kim Yo Jong and state media, denies the claim and calls it a political provocation, a response that raises diplomatic friction as authorities warn the remaining ~$3.2 billion could be converted and cashed out via OTC brokers and DeFi services.