FBI Identifies Hundreds of Wallets Tied to North Korean Hack of Binance, Urges Blockage of Stolen Crypto

The Federal Bureau of Investigation has publicly connected 628 cryptocurrency wallet addresses to the North Korean hacking group known as TraderTraitor, which is believed to have orchestrated the massive $6.3 billion theft from Binance, the world’s largest crypto exchange.

In a statement released this week, the FBI said the addresses were flagged as part of an ongoing investigation into the breach that took place earlier this year. The agency is now requesting that cryptocurrency exchanges, payment processors, and other financial service providers block any transfers that involve the identified wallets, in an effort to prevent the further laundering of the stolen assets.

The Binance hack, first reported in early 2024, shocked the digital‑asset market and prompted a wave of scrutiny over the security practices of major exchanges. While Binance has not disclosed the precise method used by the attackers, industry analysts have linked the operation to the Lazarus Group, a unit of North Korea’s Reconnaissance General Bureau that has a history of high‑profile cyber‑thefts to fund the regime’s weapons programs.

TraderTraitor, a moniker assigned by cybersecurity researchers, is thought to be an alias for a subset of Lazarus operators that specialize in exploiting vulnerabilities in centralized crypto platforms. By tracing transaction patterns, blockchain analytics firms were able to map a network of wallets that repeatedly received and moved funds in ways consistent with money‑laundering techniques, leading the FBI to the current tally of 628 addresses.

Law enforcement’s outreach to crypto service providers reflects a broader strategy to choke the flow of illicit proceeds. “Blocking these addresses is a critical step in disrupting the financial lifeline of a state‑sponsored cyber threat,” the FBI’s press release read. The agency also warned that the identified wallets may be linked to a series of rapid “mixing” transactions designed to obscure the origin of the stolen coins before they are converted into fiat currency.

Experts say the move could have mixed results. While many exchanges have compliance programs that can freeze or reject transactions tied to sanctioned entities, the decentralized nature of many blockchain services means that some actors may still find ways to move the assets through peer‑to‑peer channels or lesser‑known platforms that lack robust AML controls.

Binance, which has faced criticism for its handling of the breach, has pledged to cooperate fully with investigators and to enhance its security protocols. The exchange’s CEO, Changpeng Zhao, previously indicated that the firm would allocate additional resources to track the flow of the stolen funds and to reimburse affected users where possible.

The FBI’s identification of the wallets marks a significant development in a case that has drawn international attention. As authorities continue to piece together the full extent of the theft, the broader crypto community is watching closely to see whether the crackdown will deter future state‑backed cyber‑crime or simply shift tactics to more covert channels.