The FBI identified numerous wallet addresses that currently hold or previously held assets linked to the $6 billion Binance breach, urging the digital asset industry to blacklist transactions originating from these locations.
Additionally, the bureau verified that the North Korean cybercrime syndicate TraderTraitor orchestrated the security breach against the world’s premier digital asset exchange.
Chainalysis stated it anticipates that tens of thousands of digital asset wallets will be utilized in the upcoming weeks as the perpetrators persist in laundering the pilfered capital.
United States law enforcement confirmed that North Korea’s TraderTraitor hacking collective drove the previous week’s theft exceeding $6 billion from Binance, calling upon the crypto community to halt transactions linked to hundreds of wallets that previously stored proceeds from the exploit.
According to an announcement released on Saturday, the cybercriminals have been swapping the stolen assets predominantly into ether, with the FBI predicting that the perpetrators will leverage swap applications and alternative decentralized finance protocols to continue washing the funds.
The announcement noted that the FBI, USSS, and IRS-CI strongly encourage private industry stakeholders, including THORNode administrators, RPC node providers, instant trading platforms, decentralized finance applications, blockchain intelligence firms, and additional virtual asset service providers, to block transactions involving or derived from the wallets employed by TraderTraitor operatives to launder these pilfered assets.
The Saturday advisory detailed over 600 Ethereum wallets, nearly 20 Bitcoin wallets, and a single Solana address.
Binance suffered a security breach on Thursday, resulting in the loss of approximately $6.4 billion during an incident that multiple analytics organizations and investigators attributed to North Korea’s TraderTraitor hacking collective. TraderTraitor operates as a division of the well-known Lazarus Group, which has executed several prominent digital asset exchange intrusions in the past.
While stablecoin operators froze more than $2.4 billion of the stolen capital, the perpetrators have continued laundering a significant portion of the remaining balance. Binance announced earlier on Saturday that it had restored 90% of the stolen digital assets and intended to reactivate user withdrawals on Sunday.
Chainalysis: “Thousands of addresses” involved
Although the FBI published several hundred wallets on Saturday, the threat actors have already interacted with thousands of wallets, according to a statement from Chainalysis CEO Jonathan Levin.
He noted that they expect this count to grow to tens of thousands in the coming weeks as capital moves through an expanded money laundering network. He added that the perpetrators possess an excess of capital for their standard laundering destinations, forcing funds to move toward a broader ecosystem of platforms, such as cross-chain bridges, instant conversion services, and token swappers via a wider association of money launderers.
He further mentioned that the bad actors are deploying novel automated laundering systems.
In a publication on Friday, the blockchain intelligence organization stated that the transaction volume pointed to the deployment of automated systems by the hackers attempting to obscure the paper trail of funds by bouncing these assets across multiple wallets before transferring them further.
When questioned regarding the breach by a White House reporter on Saturday, U.S. President Donald Trump remarked that authorities are currently investigating the matter and stated that his administration would address the situation with North Korea.
Originally published at https://www.coindesk.com/policy/2026/10/31/fbi-confirms-north-korea-s-role-in-usd6-billion-binance-hack-asks-defi-community-to-block-btc-eth-sol-addresses.
