U.S. President Donald Trump said his administration would discuss the attack on cryptocurrency exchange Binance with North Korea. “We’re looking into it,” he told reporters at the White House after the FBI officially identified North Korean hackers as responsible for the breach.
The Lazarus unit
In a statement issued on October 31 jointly with the U.S. Secret Service and the Internal Revenue Service Criminal Investigation division (IRS-CI), the FBI said the October 29 attack was carried out by TraderTraitor, a unit of North Korea’s Lazarus Group. The losses exceeded $6 billion, making it the largest theft in cryptocurrency history.
The agency published more than 600 addresses on the Ethereum network, nearly 20 Bitcoin addresses and one Solana address through which the stolen funds are being laundered. It called on exchanges, DeFi services and analytics companies to block transactions linked to them.
Traces lead to ether
According to the FBI, the hackers converted most of the proceeds into ether and will continue laundering the funds through exchange services and decentralized protocols. Chainalysis CEO Jonathan Levin said the perpetrators had already used thousands of addresses, and that the number could grow to tens of thousands in the coming weeks.
Stablecoin issuers froze more than $2.4 billion of the stolen funds. Binance said it had reimbursed 90% of the stolen assets from its own funds and would gradually resume customer withdrawals, beginning with Bitcoin.
The same TraderTraitor group stole about $1.5 billion from the Bybit exchange in February 2025.