Overview
- The breach that drained $6.3 billion from Binance occurred on Oct. 29 and the FBI has formally attributed the attack to TraderTraitor, a group U.S. investigators tie to North Korean intelligence.
- Binance suspended withdrawals after the theft, has begun a phased reopening of withdrawals, and says it rebuilt roughly 90% of the missing assets by buying equivalent holdings to protect users.
- The FBI published a list of roughly 500 Ethereum addresses it says were used to launder the proceeds and urged exchanges, DeFi services and analytics firms to block transactions with those wallets while tracing continues.
- North Korea denied responsibility through Kim Yo Jong, calling the U.S. allegation a political provocation, and state media reported recent missile tests that have heightened geopolitical tensions and could complicate diplomacy.
- Security firms and U.N. reporting say TraderTraitor is linked to the Lazarus network and Bureau 121, that the group uses social engineering to compromise contractors or staff, and that Pyongyang has stolen billions in crypto over years and launders funds through mixers, private exchanges and DeFi.