The U.S. Federal Bureau of Investigation (FBI) has formally attributed the historic $6 billion Binance heist to North Korea’s state‑sponsored hacking units, publishing an extensive list of more than 600 blockchain addresses linked to the theft.
According to the bureau’s November 2026 cyber alert, the agency is urging exchanges, wallet providers, miners, and blockchain‑analysis firms to block transactions associated with these addresses to prevent laundering and further movement of stolen funds.
The disclosure marks one of the most sweeping public attributions ever issued for a crypto‑related cyberattack and underscores the scale, sophistication, and geopolitical implications of North Korea’s digital‑asset operations.
Historic Heist that Prompted a Rare Public Attribution
The recent Binance breach, which resulted in the theft of approximately $6 billion in digital assets, is now considered the largest cryptocurrency exchange hack ever recorded
The FBI’s alert states that North Korea’s Lazarus Group and its sub‑unit TraderTraitor orchestrated the attack, leveraging a combination of social engineering, malware deployment, and exploitation of internal approval systems to siphon funds from Binance’s hot‑wallet infrastructure.
More than 600 associated addresses published is unprecedented in scale. These addresses span multiple chains, including Ethereum, Bitcoin, Tron, and Solana, and represent the pathways through which stolen funds were consolidated, fragmented, and prepared for laundering.
The FBI’s decision to publicly release the addresses reflects both the magnitude of the theft and the urgency of preventing further movement of funds.
Through identification of the wallets, the agency aims to mobilize the global crypto ecosystem to freeze assets, block transfers, and disrupt laundering operations.
A Sophisticated Multi‑Stage Operation
According to the FBI’s cyber alert, the attack began with a targeted compromise of a Binance engineer’s device. Malware installed on the laptop allowed attackers to bypass internal controls and submit withdrawal transactions that appeared legitimate.
Once inside the system, the attackers executed a series of rapid transfers designed to evade detection.
Chainalysis notes that the attackers used a multi‑stage laundering strategy:
- Consolidating stolen assets into large pools
- Fragmenting funds into smaller transfers
- Routing assets through mixers, instant‑swap services, and cross‑chain bridges
- Moving funds across hundreds of addresses to obscure origin trails
Each address in the FBI’s list of 600+ addresses represents a node in the laundering network, forming a complex web of transactions that investigators must trace across chains and protocols.
North Korea’s Denial
North Korea has denied involvement, calling the FBI’s attribution “a fabricated provocation.” State media statements claim the U.S. is using cyber allegations to justify sanctions and diplomatic pressure.
However, Reuters reports that blockchain‑analysis firms, including Elliptic, TRM Labs, and Chainalysis, have independently confirmed that the techniques used in the Binance hack match patterns seen in previous Lazarus‑linked attacks, including the Ronin Bridge exploit, the Harmony Horizon breach, and multiple exchange hacks dating back to 2017.
It was previously noted by the general public that North Korea’s cyber units generate billions of dollars annually through crypto theft, providing critical funding for weapons programs and foreign‑currency reserves. The Binance heist, if fully attributed, represents a dramatic escalation in both scale and ambition.
600+ Addresses: A Global Call to Action
FBI’s publication of the addresses is intended to mobilize the entire crypto ecosystem. The alert urges:
- Exchanges to block deposits and withdrawals involving flagged addresses
- Wallet providers to monitor incoming transfers
- Miners and validators to reject transactions linked to the addresses
- Blockchain‑analysis firms to update risk databases
- DeFi protocols to implement screening mechanisms
The FBI warns that the addresses may continue to be used for laundering, even months after the initial breach. Now that the list is distributed publicly, the agency aims to create a coordinated global response that limits the attackers’ ability to cash out or move funds undetected.
