FBI attribution: TraderTraitor and North Korea
The Bureau attributed last week’s theft of more than $6 billion from cryptocurrency exchange Binance to the TraderTraitor group — also identified by aliases Jade Sleet, UNC4899 and Slow Pisces — and tied the activity to North Korea. The short advisory named the US Secret Service and IRS-Criminal Investigation as partners in the observation and described the conversion behavior the actors are using as they prepare the assets for further laundering stages.
The stolen funds: how much is frozen and what remains
Blockchain analytics company Elliptic reported that roughly $2.9 billion of the stolen funds have been frozen or seized, leaving nearly $3.3 billion outside the reach of issuers. Elliptic further quantified the residue: “At current prices, the attacker now controls around $3.25bn of assets that cannot be frozen by an issuer, spread across more than 800 addresses. This includes around 584,000 ETH ($1.32bn), 18,327 BTC ($1.42bn) and 233 million XRP.”
Elliptic added that the ETH balance includes TRX that was laundered through cross‑chain bridges, arriving on Ethereum and then split across hundreds of fresh wallets. According to the firm, almost all of the stolen TRX has already been laundered. By contrast, the XRP, SOL and NEAR holdings — together worth about $439 million — “have not moved at all since they were stolen.”
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleBinance’s response and the evolving forensic picture
Binance said it will cover the costs of the incident so customer funds are not at risk, and the exchange said it continues to investigate the root cause. Early statements from Binance blamed a compromised DevOps laptop, but the company later said it had “uncovered additional points of breach” in what it called a “complex attack.”
Elliptic reported that the attack involved more than one individual and used “a self‑destruct mechanism that destroyed tooling and traces as it ran,” complicating forensic work. Those details underscore why Binance’s investigation remains active even as the exchange promises to make whole any affected customers.
TraderTraitor’s methods and past operations
The FBI warned that TraderTraitor actors have been converting stolen assets primarily into Ethereum and that they are expected to use decentralized finance (DeFi) products and instant swap services for subsequent laundering. Elliptic described the practical mechanics in this incident: bridging TRX onto Ethereum and splitting funds across many fresh wallets to frustrate traceability.
Beyond the Binance incident, the TraderTraitor label has been connected in reporting to previous large cryptocurrency thefts. Elliptic and other reporting linked the group to attacks on Japanese firm DMM ($308m), Alphapo ($60m), CoinsPaid ($37m), Atomic Wallet ($100m) and a prior record theft from Bybit ($1.5bn). Reporting also associates TraderTraitor with known threat clusters named Lazarus Group, APT38 and AppleJeus.
What THORNode operators, DeFi services, and blockchain analytics firms are being asked to do
- THORNode operators and RPC node operators: The FBI urged these operators to block transactions involving, or derived from, addresses TraderTraitor actors are using to launder stolen assets.
- Instant exchanges and DeFi services: The advisory specifically called on instant exchanges and DeFi services to prevent transactions tied to the known laundering addresses as the actors convert assets and move them through decentralized products.
- Blockchain analytics firms and other virtual asset service providers: The Bureau asked analytics firms and VASPs to assist by flagging, blocking and sharing intelligence about transactions linked to the laundering addresses.
The record in this case is notable for scale and for the speed with which some funds were moved into cross‑chain bridges and split across many wallets. More than $2.9 billion has been frozen or seized, but Elliptic says about $3.25 billion still sits in hundreds of addresses beyond issuer controls — a tactical and legal problem that regulators, exchanges and on‑chain defenders will face together.
As investigators pursue those holdings and Binance continues its internal forensic work, the immediate operational ask from US authorities is concrete: block transactions tied to the laundering addresses and watch for rapid conversions into Ethereum and DeFi routes. The larger questions — how the multiple breach points were established, who the individual operators were, and whether the assets now held across 800-plus addresses can be recovered — remain the practical next chapters in an already historic crypto theft.
Source: Infosecurity Magazine — FBI Attributes Binance Heist to North Korea’s TraderTraitor
