FBI Attributes $6.43 Billion Binance Theft to TraderTraitor

The FBI attributed the $6.43 billion Binance theft to North Korea-linked TraderTraitor, with stolen assets traced across 11 blockchains; about $2.85 billion had been frozen or seized by Nov. 2.

Binance said the attack began Oct. 29 after an engineer’s laptop was compromised. The FBI published addresses tied to the attackers on Oct. 31.

Tron (TRX) was the main laundering route. A wallet began splitting 684.6 million TRX on Oct. 30, and the funds later spread to roughly 7,700 addresses. At least $147 million moved from Tron through bridges; nearly all bridged TRX emerged on Ethereum as Ether (ETH).

The attackers also used decentralized exchanges, lending pools and CoinJoin, a process that mixes transfers to make direct paths harder to follow. By Nov. 2, about 28 Bitcoin (BTC), valued at $2.2 million, had passed through 18 CoinJoin transactions.

The laundering process was automated, but there was no evidence that AI agents chose transactions. A small portion may have been cashed out. Stablecoin transfers and centralized cash-out services remained the clearest opportunities for freezes.