FBI Links North Korean Group TraderTraitor to Binance Theft

The FBI tied North Korea-linked hacking group TraderTraitor to Binance’s recent security breach, naming the group in a public notice as it sought to stop stolen assets from moving through crypto services.

The FBI notice listed more than 600 Ethereum addresses, nearly 20 Bitcoin (BTC) addresses and one Solana address linked to the attack. It urged THORChain node operators, RPC providers, instant transaction services, decentralized finance (DeFi) platforms and blockchain analytics companies to block activity tied directly or indirectly to those addresses.

The agency described TraderTraitor as a state-backed North Korean group active since at least 2020. It said the attackers were converting stolen assets mainly into Ether (ETH) and expected them to use token-swapping services and DeFi tools to move funds further.

About $242 million in funds linked to the theft moved through the Tron network over two days. The estimate covers transfers linked to the theft, while the FBI’s address list gives services wallet identifiers to screen across several networks.