727 FinanceAuthor: Asher, Odaily Planet Daily
This morning, a notice released by the U.S. Federal Bureau of Investigation (FBI) showed that North Korea is responsible for the theft of more than $6 billion in virtual assets from Binance this time, and referred to the related malicious cyber activity as "TraderTraitor." This group was also identified by the FBI as the attacker behind last year's approximately $1.5 billion Bybit theft.
Just yesterday, when Trump was asked whether the attack was carried out by North Korea, he also said, "We don't know, we are investigating." Now that the FBI has officially announced the attribution, the investigation into the largest theft case in the crypto industry has made new progress.
FBI Publishes Involved Addresses, Calls on Industry to Help Intercept Funds
While clarifying the attacker's identity, the FBI also disclosed the movement of the stolen funds. The FBI stated that it, together with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI), has observed that the attackers are mainly converting the stolen assets into ETH and expects them to continue laundering money through DeFi and instant exchange services in preparation for subsequent fund transfers.
To prevent the illicit funds from continuing to circulate, the FBI published the relevant addresses (relevant address link: https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack) and called on THORChain node operators, RPC node operators, instant exchange platforms, DeFi services, blockchain analytics companies, and other virtual asset service providers to block transactions related to these addresses and funds derived from them. Even if the funds have already been transferred to new wallets, as long as they can be traced back to the involved addresses, they fall within the scope the FBI is calling to be blocked. The FBI also invited individuals or institutions with leads to provide information to their local FBI office or the Internet Crime Complaint Center (IC3).
While law enforcement seeks industry assistance, the attackers are still accelerating the transfer of stolen funds. On-chain monitoring shows that some funds have repeatedly circulated among multiple old and new wallets and have successively entered exchange and cross-chain services.
Funds Transferred for 31 Consecutive Hours, Hackers Suspected of Launching Automated Money Laundering
Yesterday, the hackers continued to split, cycle back, and redistribute the stolen funds among multiple wallets. According to Onchain Lens monitoring, the attackers transferred 120 million TRX, worth about $38.78 million at the price at the time of monitoring, and then further dispersed it to multiple target addresses. After passing through multiple wallets, some funds returned to previously used addresses and then moved to new wallets, making the tracing path more complicated.
An update from Elliptic yesterday showed that the main distribution wallet on the Tron network had sent about $93.5 million to about 150 wallets while continuously receiving large replenishments of funds. The transfer speed further increased overnight, reaching about $3 million to $7 million per hour.
These transfers show obvious automated characteristics. The main distribution wallet transferred funds every hour for 31 consecutive hours, with the longest pause only 46 minutes; receiving wallets usually transferred the funds onward within about two minutes. Elliptic judged based on this that the related operations are very likely software-driven and continued running overnight.
The dispersed funds are flowing into exchange and cross-chain services. As of 16:11 yesterday, Elliptic had traced about $25 million flowing into THORChain, while another about $5.3 million and $1.8 million flowed to SunSwap and Bitget Swap, respectively. Fund transfers have extended from repeated circulation among wallets to different exchange and cross-chain channels.
90% of Assets Already Backfilled, Binance Allocates Half of SAFU Funds
While the hackers continue to transfer stolen funds, Binance is also purchasing tokens to make up the asset shortfall. According to the latest official announcement, about 90% of the affected assets have been backfilled, higher than the previously disclosed about 80%. BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC have restored full reserve backing, and the remaining about 10% mainly involves less liquid tokens, which still need to be purchased through market and over-the-counter channels.
The backfill funds came from the company's own funds, part of the SAFU fund, and part of the contract insurance fund. This morning, Binance co-CEO Yi He further stated that 50% of the funds in the SAFU fund address will be allocated to cover this loss, while the other half will continue to be retained. On-chain information shows that the address has transferred out a total of 7,500 BTC in three transactions, leaving 7,500 BTC after the transfers, worth about $580 million at the price at the time of reporting.
As the backfill progresses, what users will focus on next is whether reserves can be verified and when withdrawals will resume. Binance stated that the reserve proof snapshot as of 8:00 Beijing time on October 31 has been completed, and the full zero-knowledge proof is expected to be generated on November 3. In addition, withdrawal services still target resumption today, with specific arrangements pending further announcement.
The FBI's attribution provides direction for accountability, but the stolen funds are still circulating, and recovering the assets will take time. For Binance, the next test is to complete the remaining backfill, resume withdrawals, and publish a complete security review. Replenishing assets is only the first step; giving users confidence to deposit and withdraw is the focus of the follow-up to this crisis.