Stolen Binance XRP moves as FBI blames North Korea

The FBI has formally blamed North Korean state hackers for the roughly $6.3 billion theft from Binance and published hundreds of wallet addresses it says hold or once held the stolen funds. It asked the crypto industry to refuse any transactions tied to them. In an alert dated October 31, the bureau said North Korea was responsible for taking more than $6 billion in virtual assets on or about October 29, and named the activity "TraderTraitor." Blockchain analysts say the laundering is still going on and appears to be largely automated.fbi.gov

What the FBI asked for

The FBI, the Secret Service and IRS Criminal Investigation said TraderTraitor actors were converting the stolen assets mainly into Ethereum ↗ 1.68%. They expect the hackers to launder the money further through DeFi and instant swap services, according to the FBI. The agencies urged THORChain node operators, RPC node operators, instant exchanges, DeFi platforms and analytics firms to block transactions involving the listed addresses or funds that came from them. The list includes 608 Ethereum addresses, 19 Bitcoin ↗ 1.09% addresses and one Solana ↗ 1.45% address, SecurityWeek reported. The same group was blamed for the $1.5 billion Bybit hack in 2025, AP noted.apnews.com+2

President Donald Trump sounded less certain. "We don't know if it's North Korea," he told reporters on Saturday, though he added that this could still be confirmed, AP reported.apnews.com

Laundering continues

Elliptic puts the theft at $6.43 billion across 11 blockchains and says $2.85 billion has been frozen or seized. The attacker still controls about $3.25 billion that no issuer can freeze, spread across more than 800 addresses, according to SecurityWeek. Early on November 2, all 233 million XRP ↗ 2.24% tied to the theft moved for the first time, going to six new addresses, Elliptic said. Elliptic added that most of the remaining funds have not yet been laundered and are very likely still held by North Korea. "The Binance funds are being moved by something that does not sleep," the firm said.securityweek.com+1

Chainalysis said the launderers had moved more than $500 million through over 1,000 Tron ↗ 4.58% addresses and had started shifting funds onto Solana, Yahoo Finance reported.finance.yahoo.com

Binance's response

Co-CEO Richard Teng said the investigation has "uncovered additional points of breach" beyond the compromised laptop the exchange first suspected. He said the attacker used a self-destruct mechanism that wiped its tools as it ran, SecurityWeek reported. Binance resumed withdrawals in phases on November 1 and reported a net outflow of about $3.64 billion during the first 9.5 hours. It says it has replaced about 95% of the stolen assets and will cover all losses, according to The Business Standard.tbsnews.net+1

TRM Labs' Ari Redbord expects the hackers to break the funds into pieces and route them through smaller exchanges over months. "It's just this cat and mouse game," he told AP.apnews.com