FBI Identifies Over 600 Crypto Wallets Linked to North Korean Binance Breach

The Federal Bureau of Investigation announced Wednesday that it has traced more than 600 cryptocurrency addresses to a North Korean hacking operation believed to be responsible for the $6 billion theft from the Binance exchange.

According to the FBI, the illicit funds are being moved through a network of wallets tied to a group known online as "TraderTraitor," a moniker that investigators associate with North Korea's state-sponsored cyber units. The agency says the pattern of transactions matches previous laundering schemes linked to the country’s cyber‑crime infrastructure.

Binance, one of the world’s largest digital asset platforms, confirmed that it suffered a massive breach earlier this year that resulted in the loss of billions of dollars’ worth of crypto assets. While the exchange has not disclosed the exact method of the intrusion, analysts have suggested that sophisticated phishing, credential stuffing, and smart‑contract exploits were likely employed.

U.S. officials have long warned that North Korea leverages stolen cryptocurrency to fund its weapons programs and evade international sanctions. The latest FBI findings add to a growing dossier of evidence linking the regime’s covert hacking groups—often identified as part of the Lazarus Group—to high‑value thefts across the globe.

Law enforcement agencies in several jurisdictions are now collaborating with the FBI to freeze or seize the flagged wallets. However, the pseudonymous nature of blockchain transactions and the use of mixing services make recovery efforts challenging. Experts say that even if some addresses are seized, the bulk of the stolen assets may already be laundered through a complex web of exchanges and decentralized finance protocols.

The investigation remains ongoing, and authorities have not indicated a timeline for potential indictments or asset restitution. The revelation underscores the heightened focus on cryptocurrency security and the need for tighter regulatory oversight as digital assets become an increasingly attractive target for state‑backed cybercriminals.