Unspent Thoughts

FBI names North Korea's TraderTraitor group in $6 billion Binance hack

BITCOIN · score 8/10 · 2026-11-01

The FBI has formally blamed North Korea for the largest crypto theft on record, confirming Saturday that the TraderTraitor hacking group carried out Thursday's raid on Binance, which lost more than $6 billion.

CoinDesk puts the figure at $6.4 billion. Cointelegraph says $6.3 billion. Either way, the attribution is no longer speculation. TraderTraitor, a subunit of the Lazarus Group, had already been named by analytics services and independent researchers in the days after the breach. Now the FBI is saying it officially, and it brought the Secret Service and IRS Criminal Investigation along for the ask.

Block these addresses

The FBI's notice listed over 600 Ethereum addresses, just under 20 Bitcoin addresses, and a single Solana address that hold or have held funds from the hack. The request is broad: THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers should "block transactions with or derived from" the listed addresses.

The attackers have been converting the loot mostly into ether, and the FBI expects them to lean on swap services and DeFi tools as the laundering ramps up. Chainalysis told CoinDesk the attackers have already used thousands of addresses, and it expects "tens of thousands" more in the coming weeks.

That last number is the problem. A blocklist works when the list is stable. It falls apart when the other side can mint fresh addresses faster than anyone can publish them. The FBI is asking a decentralized network to behave like a compliance department, and some chunk of that network will simply not answer the email.

What got frozen, what got away

Stablecoin issuers froze over $2.4 billion of the stolen funds, per CoinDesk. That is a real recovery, and it shows how much of the haul was still sitting in assets with an off switch. The rest, the part already swapped into ether and pushed through DeFi, is a different story. Nobody can freeze ETH by pressing a button at headquarters.

One hack, a decade of theft

Here is the number I keep coming back to. According to CertiK, citing onchain researcher Taylor Monahan, North Korea-linked actors stole an estimated $6.75 billion across 263 documented incidents between 2016 and early 2026. This single breach roughly matches that entire decade of theft in one day.

CertiK also attributed more than $2 billion of an estimated $3.4 billion in 2025 crypto security losses to North Korea-tied groups, and Cointelegraph notes that works out to about 60% of the value lost to crypto hacks last year. The firm's conclusion was blunt: Pyongyang has "industrialized crypto theft into a core state revenue mechanism."

For scale, independent research organization MilitarySpend puts North Korea's actual annual defense spending at as much as $6 billion on a purchasing-power basis, while stressing the figure is uncertain. If that estimate is anywhere close, Thursday's haul equals a full year of military budget. Cointelegraph reports the proceeds of these thefts help fund the regime's nuclear and ballistic missile programs.

I don't know how much of the unfrozen billions the attackers will actually keep. Laundering that kind of money while every analytics firm in the industry watches is hard. But North Korea has had a lot of practice, and the address count is growing by the day.

Sources

Sources