FBI urges private sector to block transactions tied to Binance theft

Maya Collins Maya Collins

Reviewed by NV Global editorial team

Orange sphere at the center of a network of connected pale gray spheres on a light surface

Not an order: the FBI and two partner agencies urge the private sector to refuse transactions with, or derived from, 628 addresses tied to the Binance theft.

On 31 October 2026 the FBI said North Korea was behind a theft of more than $6 billion from Binance. With the US Secret Service and IRS Criminal Investigation, it urged the private sector to block transactions with 628 addresses, or derived from them.

What happened

The alert, posted on the FBI’s cyber alerts page, dates the theft to on or about 29 October. It attributes the theft to North Korean activity the bureau calls TraderTraitor. The FBI says it, the US Secret Service (USSS) and IRS Criminal Investigation (IRS-CI) have observed the actors turning the stolen assets mostly into Ether. The alert adds that further laundering through DeFi and instant swap services is expected.

The three agencies “are urging private sector entities” to block transactions involving the listed addresses, or derived from them. The alert’s call to block is a request, not an order. The alert names several types of business as examples of whom it addresses, introduced by “including”, not as a closed list.

The list that follows holds 628 addresses: 608 on Ethereum, 19 on Bitcoin and one on Solana. The FBI says these addresses “are holding or have held assets from the theft”. It describes them as “operated by or closely connected to North Korean TraderTraitor actors”.

The alert cites no legal requirement to block, does not mention sanctions, and does not say whether any funds have been frozen or recovered.

Why it matters

The request reaches past the 628 addresses themselves. In our reading, “derived from” covers funds that left those addresses and passed through other wallets or swap services before reaching a business. A check that compares only the immediate counterparty with a fixed list would not see such funds; tracing them back through earlier transfers would. The alert does not explain how to screen for them.

The format is not new. On 26 February 2025 the FBI attributed the theft of approximately $1.5 billion from Bybit to TraderTraitor. It published 51 Ethereum addresses with a request worded almost identically, with “encourages” where the Binance alert has “urging”. The lists of addressees differ. The Bybit request named exchanges and bridges; the Binance request names THORNode operators and instant exchanges, and not bridges.

The activity has an earlier attribution as well. In December 2024 the FBI, the Department of Defense Cyber Crime Center and Japan’s National Police Agency tied it to a theft from Japan’s DMM. That theft, in May 2024, took cryptocurrency then worth $308 million.

Who it affects

  • Private sector entities in general, to which the request is addressed
  • The business types the alert names as examples: instant exchanges, DeFi services, THORNode and RPC node operators, other virtual asset service providers, and blockchain analytics firms
  • Firms outside the United States: the alert does not limit the request by country
  • Compliance teams that maintain address-screening lists at any of these businesses

What businesses should do

  1. A screening list built from the alert is complete only with all 628 addresses. The request covers the Bitcoin and Solana sections as well as the Ethereum one.
  2. Record which version of the list was loaded and when, because an alert page can be revised after it is published.
  3. Record a block made on this basis as a response to an FBI request, not as a sanctions match: the alert names no sanctions designation.
  4. The alert gives two routes for related information: the FBI’s Internet Crime Complaint Center (IC3) or a local FBI field office.

Sources

Regions