UPDATED 20:48 UTC, 1 Nov: The US Secret Service said at 18:11 UTC that it continues to investigate the theft and that, within minutes of the incident on Thursday afternoon, its investigators worked with industry partners “to identify and freeze a significant portion” of the stolen crypto. It gave no amount. It named its partners as the FBI, IRS Criminal Investigation, the US Attorney’s Offices for the District of Columbia and the Central District of California, the Justice Department’s computer crime section (CCIPS) and its National Security Division, and pointed to the FBI’s address list. Separately, Chainalysis said at 16:59 UTC that the North Korean-linked launderers had drained $500 million from Tron staging wallets and “started moving onto Solana”.

SECURITY ALERT

The addresses are public now.

So is the name on them.

North Korea stole more than $6 billion in crypto from Binance on or about 29 October, the FBI said in a cyber alert published on Saturday.

The bureau calls the group behind it “TraderTraitor”.

It is the first official attribution of the theft. Until now the TraderTraitor link came from private firms, TRM Labs and Chainalysis.

What the FBI says, in UTC

  • 29 Oct (on or about). The theft from Binance, according to the alert.
  • 31 Oct, 22:36. The FBI’s Cyber Division posts the alert on X. The main FBI account reposts it 11 minutes later.

The FBI, working with the Secret Service and IRS Criminal Investigation, says it has watched TraderTraitor turning the stolen assets mostly into ether.

It expects the next step to be DeFi and instant swap services.

So who is being asked to stop it?

The ask

The agencies are “urging” the people who run THORChain and RPC nodes, along with instant exchanges, DeFi apps, analytics firms and other crypto businesses, to refuse any transaction “with or derived from” the listed addresses.

That puts THORChain’s node operators by name on a federal list of people asked to act, while THORChain’s emergency pause is still holding up swaps.

The list has 608 Ethereum addresses, 19 bitcoin addresses and one Solana address. The FBI says they hold or have held assets from the theft.

What is still sitting in them?

What we can see

We checked one address from each of the two main chains on Sunday morning.

The first Ethereum address on the list held about 197,460 ETH at 04:50 UTC, roughly $447 million at Kraken’s price. It has never sent a transaction.

0x8532FA14ACAf483729C449b8458aedDb900543D4

One of the bitcoin addresses had received 1,000 BTC, about $77.7 million, and spent none of it.

bc1qxrxujwxfnvz040jw76d26zhjdg5jura7hs968s

The money is labelled. It has not moved. Those are not the same as frozen.

Protect yourself

  • If you run a node, a bridge front end or a swap service, load the FBI list now. The full list is on the alert page.
  • If a payment to you traces back to a listed address, do not move it on. Report it to your local FBI field office or at ic3.gov.
  • Binance customers: the exchange plans to restart withdrawals in phases from 06:00 UTC today. Use only its official site and app; hack headlines bring phishing.

A blocklist works when everyone loads it. Who will be the first not to?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.