FBI asks crypto sector to block addresses after Binance hack tied to North Korea
U.S. authorities are intensifying efforts to contain the fallout from the theft of more than $6 billion from Binance after tracing the attack to North Korea-linked actors. The warning highlights rising laundering risks across decentralized finance networks as investigators say the stolen assets are already being moved through multiple blockchain addresses.
Highlights
- The FBI attributed last week's $6.4 billion Binance hack to North Korea’s TraderTraitor group and requested the crypto sector block hundreds of linked addresses.
- Hackers have laundered portions of the stolen assets via ether, swaps, and DeFi tools, prompting federal warnings to THORNode, RPC node, instant exchange, and analytics providers.
- Chainalysis expects thousands to tens of thousands of addresses may be involved as the stolen funds move, significantly raising compliance pressures for DeFi and blockchain operators.
Federal warning targets laundering routes
As reported by CoinDesk, citing the FBI, North Korea’s TraderTraitor hacking group is behind last week’s theft from Binance, and the agency is asking the crypto industry to block transactions involving addresses linked to the stolen funds.In its Saturday statement, the FBI says the hackers are converting much of the stolen assets into ether and are likely to keep using swap services and other decentralized finance tools to launder the proceeds. The agency says private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers should block transactions with or derived from addresses used by the group.
The notice lists more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address that at one point held funds from the hack.
Crypto industry faces broader compliance pressure
Binance was hacked on Thursday, losing about $6.4 billion in an attack that several analytics firms and individuals attributed to TraderTraitor, a subunit of the Lazarus Group. The group is linked to a series of high-profile breaches targeting crypto exchanges.Chainalysis says the attackers have already used thousands of addresses and expects that figure to keep rising in the coming weeks. It also says tens of thousands of crypto addresses could ultimately be involved as the stolen funds continue moving across networks, adding to monitoring and compliance demands for DeFi operators and blockchain service providers.
In our earlier article on the Q3 surge in cybersecurity and privacy startup funding, we noted that total investment climbed to $6.8 billion largely on the back of bigger late-stage rounds even as deal counts fell. We also highlighted how AI-driven and identity security firms led fundraising, alongside major acquisitions that signaled accelerating consolidation across the sector.