FBI says North Korea stole more than $6 billion from Binance and lists 628 addresses to block

628 addresses on three chains, about two days after the theft

The FBI alert on the Binance theft lists 628 addresses: 608 Ethereum (ETH), 19 Bitcoin (BTC) and one Solana (SOL). That count is this site's, made from a copy of the alert saved at 10:48 UTC on Sunday 1 November 2026 (derived). None of the 628 appears twice, all 608 ETH addresses pass the mixed case checksum that Ethereum addresses carry, all 19 BTC addresses pass their bech32 checksum, and the SOL address decodes to the 32 bytes a Solana address should (all derived). In short, the list as published is internally clean: nothing in it looks mistyped. The alert is dated October 31, 2026, and the page's own metadata records its creation at 19:44:33 UTC that day. Binance says its hot wallets were compromised at around 20:05 UTC on 29 October, so the alert came about 47 hours 40 minutes later (derived).

The FBI says the Democratic People's Republic of Korea "was responsible for the theft of more than $6 billion USD in virtual assets" from Binance, "on or about October 29, 2026", and that it "refers to this specific North Korean malicious cyber activity as 'TraderTraitor.'" It names the US Secret Service (USSS) and IRS Criminal Investigation (IRS-CI) as partners, and asks node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions with or derived from the listed addresses.

What the alert does not establish matters as much. It gives no entry route and no method, no exact sum, no frozen total and no confidence wording, and it announces no charge. Its addresses sit on three chains, while Elliptic counts eleven chains in the theft and says 233 million XRP sits untouched in a single address that the FBI list does not include. A government attribution is still an attribution: the evidence the alert publishes is the address list, and the reasoning behind it is not on the page.

What changed since this site's briefing of 30 October: then, the North Korea attribution belonged to two blockchain analytics firms, TRM Labs and Chainalysis, and no government statement on this theft had turned up. Now the FBI has made one, with addresses. That briefing covers Binance's conditional account of a compromised DevOps laptop and the night's on chain record; this one does not repeat them.

Sources, read from 10:48 to 10:52 UTC on 1 November 2026: the FBI alert itself, read in a normal browser because fbi.gov answers scripts with a block; Binance's own announcements of 30 October, 30 October, update 2, 31 October and 1 November; Elliptic's post, last updated at 08:00 UTC on 1 November; TRM Labs' post; the FBI's February 2025 announcement on Bybit; and The Hacker News of 1 November, read only as a pointer. Binance is the victim and gives its own account; Elliptic, TRM Labs and Chainalysis sell blockchain analytics and screening, so a widely adopted blocklist is also their market.

What the alert states, and what it leaves out

The alert is short: two paragraphs of finding, one request, one reporting line and the address list. The table sets each point against what the page does not say. Where the FBI's words carry the weight, they are quoted.

Two phrases deserve a slower read. "Holding or have held" means some listed addresses may now be empty, so a match is a lead about where money came from, not proof of where it is. And "operated by or closely connected to" North Korean actors covers both the attacker's own wallets and addresses close to them; the alert does not say which is which.

The template is familiar. The FBI's announcement of 26 February 2025 said North Korea was responsible for the theft of about $1.5 billion from Bybit "on or about February 21, 2025" and used the same TraderTraitor wording. That list held 51 Ethereum addresses and came five days after the theft; this one holds 628 addresses on three chains and came two days after (both derived). None of the 51 Bybit addresses appears in the Binance list (derived). The Bybit request named "exchanges" and "bridges"; the Binance request names THORNode operators and "instant exchanges" instead, and does not name bridges.

Whose figure is whose

The FBI's number is "more than $6 billion". The number in most headlines on 1 November, $6.43 billion, is Elliptic's. The Hacker News, for example, headlined that the FBI "links" TraderTraitor to a "record $6.43 billion" theft; the alert links TraderTraitor to "more than $6 billion" and prints no other figure. That pairing of a government finding with a private figure is the friendly name at work in this story: a figure acquires the FBI's authority by sitting next to its name. Each figure below is a different count by a different party at a different time.

The spread between the lowest named figure, Binance's $6.3 billion, and Elliptic's $6.43 billion is about 2 per cent (derived: 6.43 divided by 6.3). Elliptic says its total excludes a further $169 million that left Binance after withdrawals were suspended, which it reads as Binance moving its own funds. The frozen figures differ in method as well as hour: Elliptic counts frozen or seized funds at current prices, and its own chart excludes an Aave position holding $59.9 million of collateral. The Hacker News lists Tether, Circle, Ripple, Arbitrum and Optimism as the freezers; Elliptic's longer list adds World Liberty Financial, Paxos, First Digital, Binance's own WBETH and several smaller issuers.

Binance's own loss accounting is a separate thing again. It says it set aside "more than $6.34B in company funds" and has covered approximately 80 per cent, then 90, then 95 per cent of the impacted amount, the last in its 1 November update, with the remaining 5 per cent in tokens outside its top ten. Cover is a promise to customers about balances, not a recovery of what was taken.

The incident record: dates, containment and the way in

Breach dates are easy to blur. The table keeps the access window, discovery, containment, notification and publication apart, and marks the gaps.

On withdrawals, Binance's 1 November update says it is "preparing to resume phase one of withdrawals on 2026-11-01 between 06:00 and 09:00 (UTC)", in phases, with updates on its X account. Elliptic's post records that at 06:00 UTC on 1 November Binance announced it had begun reopening withdrawals, starting with the Bitcoin network. This site has not checked any withdrawal itself. Binance says deposits were not affected. The phase one list, as Binance prints it:

None of the four Binance notices read for this briefing mentions North Korea, TraderTraitor or the FBI alert. Binance's 30 October notice says it is working with law enforcement "to confirm the identity of these criminals"; its 1 November notice thanks partners and says it will keep working with law enforcement "to support recovery efforts and hold those responsible accountable".

What the address list covers, and what it leaves out

Of the 628 addresses, 608 are ETH, 97 per cent of the list (derived: 608 divided by 628). That fits the FBI's own observation that the assets were converted primarily into Ether. Three gaps are worth knowing before anyone loads the list and calls the job done.

Zoom

First, chains. Elliptic counts eleven blockchains in the theft, including the XRP Ledger, Tron and NEAR, and says the 233 million XRP has not moved from a single address. The FBI list has no XRP, Tron or NEAR address. The alert does not say why. One possible reading is that it lists only addresses whose link it is ready to state; another is that it lists where laundering is under way. Neither is stated.

Second, the label "ETH addresses". The same address format is valid on every network that runs the Ethereum virtual machine, including Arbitrum, Base, Optimism, BNB Smart Chain, Polygon and Avalanche's C chain. The alert does not say whether its request covers the same addresses on those networks. Screening them there as well costs little and is this site's recommendation, not the FBI's instruction.

Third, size. Elliptic says its free blocklist for this theft held more than 8,000 addresses by 1 November, and that the attacker controls around $3.25 billion of assets an issuer cannot freeze, spread across more than 800 addresses. The FBI's 628 is under 8 per cent of Elliptic's blocklist count (derived: 628 divided by 8,000). The lists are built for different purposes and by different methods, so the comparison says the FBI list is a floor, not a census. One detail lines up: Elliptic says the 18,270 stolen BTC were split into 19 addresses, and the FBI lists 19 BTC addresses. Elliptic prints no addresses, so whether these are the same 19 cannot be checked here.

An attribution with addresses, not a case

Zoom

The private firms showed their reasoning and hedged it. TRM Labs, in its post with figures as of 00:30 UTC on 30 October, wrote "We make this judgment with high confidence", on the basis of "robust on and off-chain intelligence". Chainalysis's investigators "assess" it, as this site recorded on 30 October. Elliptic, which had assessed TraderTraitor as likely, lists its basis: Binance funds laundered alongside proceeds of the September Bitget theft, "common service usage" with those behind three earlier TraderTraitor thefts (BigONE, WOO X and AFX), a method that resembles Bybit, and the scale of an attack across eleven blockchains.

The FBI states its conclusion without a confidence word and publishes the addresses, not the reasoning. That is normal for an alert whose purpose is to get the industry blocking quickly, and the FBI has sources the firms do not. But a reader should keep the two separate: the alert tells you who the US government says did it, and gives you a list to act on. It does not tell you how Binance was entered, and it is not an indictment, a sanctions designation or a seizure order.

Elliptic writes that the FBI has also attributed the Bybit and DMM Bitcoin thefts to TraderTraitor. The Bybit attribution is the February 2025 announcement read for this briefing; the DMM Bitcoin attribution was not read here.

The group's known lures, as background only

The Hacker News says TraderTraitor is also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899. The FBI alert uses none of those names. Microsoft's post of 29 October 2026 describes Jade Sleet, between 8 and 12 June 2026, posing as recruiters for "a spoofed AI-powered blockchain intelligence company" and using "software engineer-themed opportunities" to reach people in cybersecurity, AI, blockchain and recruitment, then running similar approaches through two more front companies within days. The Hacker News also reports, citing Zscaler, trojanised Terraform providers used to deliver malware; that report was not read for this briefing.

Technical details

The alert's artifacts are its request, its address list and its reporting route. They are copied below exactly as the FBI published them, from the copy saved at 10:48 UTC on Sunday 1 November 2026. Wallet addresses are public blocklist indicators, not live infrastructure, so they are not defanged; they are copied as published, with the original mixed case kept because Ethereum checksums depend on it. The BTC and SOL addresses are given in full. The ETH list is long, so only the first ten are printed here; load the full 608 from the alert itself, not from this page.

The request. This is the sentence that tells a screening team what to do and whom it applies to.

FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets. See the full list of addresses below.

What the FBI says it observed and expects. Use it to decide where to look: conversions into ETH, then DeFi and instant swap services.

The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.

The list header, then the first ten of the 608 ETH addresses, in the order the alert prints them.

The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:

ETH addresses

0x8532FA14ACAf483729C449b8458aedDb900543D4
0xc887aF690E0301CD4edBbCe8F8d31b4EC65B286A
0x897C80d1a9729E94460e2Bd93178bD5215158DF3
0x54401f80Da97893a15D43566184635B6674BC942
0x79e70d139fC05AA75F75611fDF2680E9952B544A
0x03b0eE5d82990cFF1bDa48651AC3e436d1a020ea
0x294828705974AD04d86A24a2ff6eFe762505A0Ed
0xa0b35142e3409e73d23bc893a17D35e156baAcb3
0x2c461674652D4d4586841887F6728F62c138fCa6
0x69FaD82C8E46F6f8d507F7329850CC8D0920b403

(598 more ETH addresses follow in the alert; count derived)

All 19 BTC addresses. The alert prints them in two groups, of ten and nine, separated by a blank line; the gap is kept.

BTC addresses

bc1qxrxujwxfnvz040jw76d26zhjdg5jura7hs968s
bc1qepc70u3u476vgvg3hfcwjgu4mecxe2uchs4lag
bc1qdfhmlrdvg4tm87zjl0vyf0xflp5ql50q3g88gw
bc1qnq6jj9jmlf3945m3l8s0kxnqehrsga300k8t3s
bc1q42flhayrzy3zh8lkyevw8qcjduurt9a35wlsyx
bc1qz8hdwv8gmml0u96dsvnzsagz6krjyzxmgxupdp
bc1qm2j6v3247khlwzxl7p9vqnfkghcllyhv9wjaat
bc1q0ts8gaf9ht0rr4u02hr56f8thndqsc4kmkmfv3
bc1q2wvz0kcsn4hqmajwtey30ud27fl25w8pveznn6
bc1qalwnl7dtaa73fsq5tyn0ghfy3fgfpqkt69tca8

bc1qjwdw6vrzq4vf6hckutvx4ucj86awwv99mxnz7w
bc1qs3aej5tmcdz0vctz8y9rjcxtxg8v5385577s56
bc1q63qrfrpsg5hh0zzn3kp2xx9vljl7dq7tatsjxp
bc1qs6xnmhar38z44g2za93pv8ygdcwurrh8l87w3v
bc1qg3nrzpuvq2pxqx74tcrywr09dc208ze96n3t53
bc1qf5cyvv9w50tx9xx9s3xwsne0z87wvjj9l8a35u
bc1qm8v88m5fy6kuq9myva2eemwycxqd3e0zcrs2l8
bc1qrg025e2pgx0rwya2kpgtj30972p64jt0hn6zyt
bc1qxg0l4p6xc50zuv9cl5f0l0wmaxjpg8wcy7s9ra

The single SOL address.

SOL addresses

AffzFDKZbyMiU11zmVBoAqD25ugpr7xoWWyRyGigBEaU

Where to report a match. Report through these routes; the alert gives no case reference.

The FBI maintains its commitment to protecting the virtual asset community by identifying, mitigating, and disrupting North Korea's illicit cybercrime and virtual asset theft activities. If you have any information to provide, please contact your local FBI field office or FBI's Internet Crime Complaint Center at ic3.gov.

This site's checks on the published list, for anyone importing it. Each line is derived here, not stated by the FBI. A team that imports the list should be able to reproduce these numbers; if its import gives a different count, something was lost in copying.

ETH addresses: 608 (unique, case insensitive: 608)
ETH addresses passing the mixed case checksum: 608 of 608
  (the alert prints them in two blocks of 304 separated by a blank line)
BTC addresses: 19 (unique: 19), all 42 characters, all valid bech32
SOL addresses: 1, decodes to 32 bytes
Total: 628
Overlap with the 51 ETH addresses in the FBI Bybit announcement of 26 Feb 2025: 0

What virtual asset businesses and analysts should do, in order

Items one to three follow the alert's own request. Items four and five are this site's, and the fifth rests on background reporting that no source ties to this theft.

The question that exposes the gap

The FBI has said who, and has published where some of the money sits. Binance has said what it lost and that it will cover it. Nobody official has yet said how a laptop, or whatever the "additional points of breach" were, reached a system that could make hot wallets on many chains sign. Until Binance's post incident report arrives, can any exchange show that its own signing path would refuse a withdrawal it did not originate, and how many hours would it take that exchange to start blocking the next list the FBI publishes?

Key facts