The warning comes as Binance begins restoring withdrawals after replenishing approximately 95% of the stolen assets using company resources. Meanwhile, investigators are racing to prevent the attackers from moving billions of dollars through increasingly complex laundering networks.
What Does the FBI Want Crypto Services to Block?
The FBI published more than 600 Ethereum addresses, nearly 20 Bitcoin addresses and one Solana address connected to the theft. The addresses either currently hold stolen assets or previously received funds controlled by TraderTraitor.
The agency, working alongside the U.S. Secret Service and IRS Criminal Investigation, urged exchanges, THORNode operators, RPC node operators, instant-swap services and DeFi platforms to block transactions originating from or derived from the identified addresses.
Investigators observed the attackers converting stolen cryptocurrencies primarily into Ether. They expect additional transfers through decentralized exchanges and instant-swap services as the group attempts to move assets beyond the reach of existing enforcement measures.
The request extends beyond conventional centralized exchanges, where compliance teams can restrict accounts and deposits. Decentralized protocols and blockchain infrastructure providers have different technical capabilities, making coordinated enforcement more complicated.
Publishing the addresses gives service providers a common reference for screening transactions, although the list cannot cover every destination as stolen funds continue moving.
Investor Takeaway
The FBI’s address disclosure strengthens transaction screening, but preventing further laundering depends on cooperation across services with different levels of transaction control.
How Are the Binance Hackers Laundering the Stolen Funds?
Chainalysis has identified thousands of transactions suggesting that TraderTraitor is using automated systems to distribute stolen assets across numerous wallets.
Instead of moving funds directly through a sequence of addresses, the attackers have repeatedly circulated cryptocurrencies between old and newly created wallets. Some addresses receive identical small TRX transfers before participating in subsequent transactions, suggesting programmatic wallet preparation.
Chainalysis CEO Jonathan Levin warned that the number of addresses involved could eventually reach tens of thousands as the operation expands across bridges, exchanges and other liquidity providers.
The attackers have also exploited differences between cryptocurrencies that can be frozen by their issuers and native blockchain assets such as Bitcoin and Ether, which lack equivalent centralized freezing mechanisms.
As previously examined in FinanceFeeds’ analysis of the stolen funds, stablecoin issuers and blockchain networks restricted approximately $2.8 billion to $3 billion in assets during the initial response.
However, some stolen stablecoins were converted into ETH before the restrictions took effect. Investigators also identified the use of decentralized lending infrastructure to move value through transferable receipt tokens, potentially complicating address-based freezing efforts.
Freezing an address does not automatically reverse completed transactions or recover funds already converted into other assets.
Has Binance Recovered the Missing $6.3 Billion?
Binance has made substantial progress replacing the stolen assets, but the replenishment should not be confused with recovering funds from the hackers.
In its November 1 recovery update, the exchange said it had covered approximately 95% of the affected amount, up from 90% in its previous announcement. The remaining 5% consists primarily of less-liquid tokens that require additional purchases through market and over-the-counter channels.
Binance said balances in ten major cryptocurrencies, including BTC, ETH, USDT, USDC, BNB and XRP, were fully backed. It reiterated that customers would not bear the financial impact of the theft.
The exchange has also begun restoring withdrawals in phases, initially prioritizing frequently requested assets and networks. Bitcoin, Ether, major stablecoins and several other cryptocurrencies are included in the initial rollout, with additional services returning after security checks.
The company’s preliminary investigation into the security breach initially identified a compromised engineer’s laptop but subsequently uncovered additional points of intrusion. Binance has reported no evidence of leaked wallet private keys, while the complete attack sequence remains under investigation.
Investor Takeaway
Binance’s 95% asset replenishment supports customer balances, but it does not reduce the amount of stolen cryptocurrency still requiring recovery or containment.
Why Does the North Korean Attribution Matter?
TraderTraitor has previously been linked to several major cryptocurrency thefts, including the approximately $1.5 billion Bybit breach in February 2025. The Binance attack is considerably larger and represents the biggest cryptocurrency theft recorded to date.
The FBI’s confirmation provides a clearer basis for coordination among financial institutions, blockchain analytics firms and law enforcement agencies investigating North Korean cryptocurrency operations.
Yet attribution alone does not determine whether stolen assets can be recovered. The immediate challenge is identifying new laundering destinations faster than the attackers can move funds through decentralized liquidity networks.
For Binance customers, the next operational milestones are the completion of withdrawal restoration, replenishment of the remaining affected assets and publication of the exchange’s detailed incident report. For investigators, the priority is preventing the already-identified stolen funds from disappearing into a much larger network of intermediary wallets and services.
