FBI Confirms North Korea Role in $6B Binance Hack, Flags BTC, ETH, SOL Addresses

The FBI has officially confirmed North Korea’s TraderTraitor hacking group was responsible for the theft of more than $6 billion from Binance on or about October 29, 2026, making it the largest crypto hack in history and roughly four times the scale of the $1.5 billion Bybit breach in early 2025. In a joint alert issued with the U.S. Secret Service and IRS Criminal Investigation, the bureau is now calling on the DeFi community to block linked Bitcoin, Ethereum, and Solana addresses.

FBI attributes the $6 billion Binance hack to North Korea

The FBI’s joint alert attributes the attack to TraderTraitor, the same state-sponsored unit behind the Bybit hack. The bureau did not confirm a specific initial infiltration vector, though initial investigation reports cited by ABC News pointed to a compromised DevOps engineer laptop; the FBI has not officially corroborated that detail. For related coverage, see Binance Announces bStock Listings for Five USDT Pairs.

Blockchain analytics firm TRM Labs estimated approximately $6.36 billion was drained across 10 blockchains, with Ethereum leading at roughly $3.79 billion, followed by Bitcoin at $1.47 billion (18,270 BTC), Tron at $628 million, XRP Ledger at $296 million, and Solana at $96 million, with smaller amounts on Arbitrum, Avalanche, Optimism, Base, and Polygon.

The attack exploited EIP-7702, a feature introduced in Ethereum’s Pectra upgrade in May 2025, using 50 pre-signed authorizations against Binance hot wallets. That allowed the attacker to drain 167,464 ETH and 63 tokens in a single transaction, then continue sweeping new deposits for hours before the breach was contained.

Stablecoin issuers and blockchain governance councils have frozen an estimated $2.7 to $3 billion of the stolen assets, including approximately $1.77 billion by Tether, $825 million by Circle, and smaller amounts by Ripple and World Liberty Financial. Hackers still control roughly $2.4 billion, including more than 420,000 ETH and 18,270 BTC, according to TRM Labs. Binance has said it will cover all remaining user losses through its SAFU fund and company reserves, with approximately 90% of impacted amounts already replenished.

Why the FBI wants DeFi platforms to block BTC, ETH and SOL addresses

The FBI’s alert lists over 600 Ethereum addresses, approximately 20 Bitcoin addresses, and 1 Solana address, urging THORNode operators, RPC node operators, DeFi services, instant exchanges, and blockchain analytics firms to voluntarily block transactions from those wallets. The stolen assets are being primarily converted into ETH, with further laundering expected through DeFi swap services and cross-chain bridges.

The scalability gap is significant. Chainalysis CEO Jonathan Levin told CoinDesk that attackers had already used “thousands of addresses” and expected “tens of thousands” more in the coming weeks. “They have too much money for their trusted laundering venues to handle,” Levin said. The FBI’s list of hundreds of addresses is already well behind actual laundering activity.

On-chain investigator ZachXBT confirmed that stolen funds from the Binance exploit commingled with funds from a separate $388 million Bitget exploit at the same address via THORChain, linking both incidents to the same TraderTraitor actor.

Chainalysis stated it has “a high degree of confidence that DPRK is responsible for the $6.4 billion hack of Binance,” noting its investigators observed Bitget exploit funds commingling with Binance funds on-chain. The reserve data impact from the hack has already been detailed separately.

What DeFi users and platforms should watch next

The request from the FBI is voluntary, not legally binding, which raises an immediate question about enforcement. DeFi protocols are permissionless by design, and blocking specific addresses requires active intervention from node operators and front-end providers. Not all participants will comply, and some may lack the technical infrastructure to screen at the address level.

Platforms should review their exposure to the flagged addresses and update transaction-monitoring practices based on the FBI’s published list. Users should rely on official notices from their specific services before drawing conclusions about their own holdings. Wall Street analysts have been tracking crypto equity implications of the hack as well.

The voluntary nature of the blocking request is likely to intensify regulatory pressure. If thousands of addresses are already in active use and the FBI list covers only hundreds, the gap will drive calls for mandatory compliance frameworks for DeFi platforms, particularly those operating under U.S. jurisdiction. The backing status of affected assets remains a separate but closely watched variable. Market sentiment sits at a Fear score of 34 out of 100, with ETH trading at $2,268 and BTC at $77,654 at time of publication.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.