The U.S. Federal Bureau of Investigation (FBI) has unveiled that a recent cyberattack on Binance, estimated to be worth $6.4 billion, was orchestrated by the North Korea-linked hacking group known as TraderTraitor. In its public disclosure, the FBI shared multiple crypto addresses linked to the attack, calling on industry participants to intercept any transactions associated with these addresses.
Comprehensive Address List Released by Authorities
The FBI’s list includes over 600 Ethereum addresses, nearly 20 Bitcoin addresses, and one Solana address. According to the bureau, these addresses still hold stolen assets or have had contact with the stolen funds. Moreover, a significant portion of the illicitly obtained assets have been reportedly converted into Ethereum. The FBI anticipates that the attackers will leverage exchange services and decentralized finance (DeFi) platforms in an attempt to obfuscate the transaction trail further.
In a coordinated move, the FBI, U.S. Secret Service, and IRS Criminal Investigations division urged private sector entities—including THORNode operators, RPC node managers, instant swap platforms, DeFi services, and blockchain analytics firms—to halt all transactions linked to TraderTraitor’s addresses.
Blockchain Firms Prepare for Increased Illicit Activity
Blockchain analysis firm Chainalysis has noted that the attackers have already employed thousands of different addresses and predicts this number could expand into the tens of thousands in the coming weeks. This massive movement of funds might facilitate the dispersion of money across a wider laundering network.
Chainalysis, a leading firm in blockchain forensics, reported that the perpetrators are utilizing automated tools to obscure traces of the assets, moving them across numerous addresses before advancing them to various services.
Chainalysis CEO Jonathan Levin stated that they expect a surge in the number of addresses involved, citing the spread of such large sums across broader networks and through more intermediaries.
The firm also highlighted the deployment of new, automated money laundering techniques by the hackers. In its recent assessment, Chainalysis described the transaction volume and routing patterns as indicative of a systematic attempt to disguise the origin of the funds.
Efforts to Freeze Funds; Binance Responds
Stablecoin issuers have managed to freeze over $2.4 billion worth of the stolen assets. However, the attackers have continued to circulate a substantial portion of the remainder. On Saturday, Binance announced that it has accounted for 90% of the pilfered crypto assets and plans to resume customer withdrawals by Sunday.
TraderTraitor is considered an offshoot of the Lazarus Group, infamously tied to significant cryptocurrency heists. In response to the situation, former U.S. President Donald Trump remarked that his administration had been briefed on the developments and pledged to address the issue with North Korea directly.
