FBI links $6bn Binance theft to North Korea’s TraderTraitor

The FBI has attributed the theft of more than $6 billion from Binance to North Korea, naming its cyber group TraderTraitor and asking crypto services to block addresses linked to the stolen assets. The bureau says the theft happened on or about October 29. In its October 31 alert, it said the stolen assets were being converted primarily into ether, with further laundering through decentralized finance (DeFi) and instant swap services expected.

The attack worked through Binance’s hot-wallet infrastructure: hot wallets hold crypto connected to the internet so an exchange can move funds. Binance later told reporters that attackers spent months compromising employee devices, then used stolen credentials and an Ethereum feature called EIP-7702 to gain execution rights over a hot wallet. That permission let them run attacker-controlled code and transfer assets out. Binance’s hot wallets use multiparty computation, which spreads signing authority across multiple parties; the exchange said that made it harder to revoke the permission quickly.

How did the attackers get access to the wallet?

Binance’s account, reported by CoinDesk, describes a long intrusion rather than a single stolen password. A software engineer was approached through a legitimate job platform, interviewed by people posing as recruiters and asked to download a coding assignment that contained malware. Binance also said another engineer had installed a tampered software package months earlier. The attackers used access to employees’ devices and internal systems to reach wallet infrastructure.

On October 29, the attackers used stolen credentials to deploy a container and run a malicious script, Binance said. Funds then left its wallets. EIP-7702 allows an externally owned Ethereum account to authorize code execution through a smart contract. In this case, Binance said the authorization gave the attackers a route to move assets from the hot wallet outside the exchange’s normal withdrawal process.

What is the FBI asking crypto services to do?

The FBI, the US Secret Service and IRS Criminal Investigation want infrastructure providers to block transactions from addresses holding or moving the stolen assets. The alert names THORNode operators, RPC node operators, instant exchanges, DeFi services and virtual-asset providers. RPC nodes connect applications to blockchain networks; swap services exchange one token for another. Blocking a flagged address can interrupt a route for moving funds, though it does not reverse a transfer already recorded on a blockchain.

The bureau says the attackers are converting assets mainly into ether and may use DeFi and instant swaps to launder them. That matters because each transfer can move the funds through a different service or address, making the trail harder to follow. The FBI published wallet addresses for services to screen and block.

How large is the theft, and what happens to customers?

The FBI’s alert puts the theft above $6 billion. The Associated Press reported Binance said more than $6 billion was taken and that the exchange had enough of the same assets set aside to cover 90% of the missing funds, with a promise to reimburse customers fully. The amount sets the scale; the recovery effort now depends partly on whether exchanges and other crypto services can stop further movement.

Sources

• October 31 alert — fbi.gov
• CoinDesk — coindesk.com