What is new: FBI attributes the Binance hack to North Korea's TraderTraitor group and asks firms to block laundering addresses

The FBI, with the US Secret Service and IRS Criminal Investigation, said on 31 October that North Korea's TraderTraitor group, a subunit of Lazarus, was responsible for the Binance hack of 29 October, reported at about $6.3 billion. It asked private-sector firms, including THORNode and RPC node operators, instant exchanges, DeFi services and analytics firms, to block transactions linked to the attackers' laundering addresses.

The notice lists more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address. The hackers mainly converted the stolen funds into ether, and the FBI expects them to keep laundering through swap services and DeFi tools. Stablecoin issuers have frozen more than $2.4 billion of the stolen funds.

Chainalysis CEO Jonathan Levin said the attackers have already used thousands of addresses and expects tens of thousands in the coming weeks. Binance says it has replaced 90% of the stolen crypto and plans to resume customer withdrawals on Sunday.