The FBI Asked Crypto to Block 600+ Addresses Tied to the Binance Hack. Chainalysis Says North Korea Is Already Using Thousands

On Saturday the FBI gave the crypto industry a blocklist for the biggest theft in its history: more than 600 Ethereum addresses, just under 20 Bitcoin addresses and a single Solana address, according to CoinDesk.

The same day, Chainalysis CEO Jonathan Levin told CoinDesk the attackers were already using “thousands of addresses,” and added: “We anticipate this will become tens of thousands over the coming weeks.”

So the official list was smaller than the laundering operation before anyone had loaded it.

What’s New Since Yesterday

We’ve covered this hack twice: the “compromised laptop” explanation on Thursday, and Binance walking that back on Friday. Here’s what happened in the 24 hours after that:

• The US government made it official. The FBI attributed the theft to “North Korean state-sponsored unit known as TraderTraitor” (Reuters/NBC wording). On Friday, private analytics firms had pointed to North Korea and Binance hadn’t named anyone. Now the FBI has.
• It’s the same crew as Bybit. The FBI tied TraderTraitor to the $1.5B Bybit hack in February 2025. That means one unit has taken roughly $7.8B from two exchanges in under two years.
• Binance says 90% is “replenished.” That’s re-bought, not recovered (more on that below).
• Withdrawals are scheduled to come back Sunday. Binance says it’s “on track,” subject to security checks and final confirmation. As of this writing, we haven’t seen confirmation that they’ve actually reopened.

The Blocklist

Per CoinDesk, the joint alert from the FBI, the Secret Service and IRS-CI urges:

“private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.”

Look at who’s on that list. It’s not just exchanges with compliance departments. THORChain node operators and RPC providers are named directly. After Bybit in 2025, THORChain processed much of the laundered ETH-to-BTC swap volume, and the protocol’s governance fight over whether to block it ended with core contributors quitting. The FBI is now naming that layer of infrastructure in writing.

The FBI says TraderTraitor has been seen “converting stolen assets primarily into” Ethereum (ABC), and expects the next stage to go through DeFi and “instant swap services.”

Why “Thousands” Matters

Levin’s explanation of what happens next, to CoinDesk:

“They have too much money for their trusted laundering venues to handle. So the money will flow to a wider network of services, like bridges, instant exchanges, and swappers…”

Chainalysis also says the attackers are using “novel automated laundering mechanisms” to spread funds across fresh addresses. An address blocklist is a snapshot. Automated peel chains produce new addresses faster than an alert can be updated, so every bridge and swapper that only screens against the FBI’s list is checking against something that was already stale on Saturday.

TRM Labs’ Ari Redbord told ABC he expects the funds to be split up and pushed through smaller exchanges “over months”: “It’s bank robbery, in this case, at the speed of the internet.”

On freezes: CoinDesk reports stablecoin issuers have frozen over $2.4B of the stolen funds, “but the attackers have continued laundering much of the remainder.” The ETH and BTC are the part nobody can freeze, and the FBI says ETH is where the stolen funds are going.

”90% Replenished” Is a Purchase, Not a Recovery

CZ-era Binance had SAFU. Teng-era Binance is now spending it. Richard Teng on X:

“We’ve now replenished 90% of the stolen assets, and we’re committed to covering the remaining 10%. Our users will not bear the financial impact of this incident.”

CNBC puts it precisely: Binance has “restored backing for about 90% of the $6.3 billion in token assets stolen from its hot wallets; that doesn’t mean it has recovered 90% of the funds from the attacker.”

According to Reuters, the money came from:

1. Part of its $1B Secure Asset Fund for Users (SAFU)
2. Part of its Futures Insurance Fund
3. Binance’s corporate treasury

Binance has set aside about $6.34B in total. It says BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are now 100% backed. The missing 10% is tokens outside the top 10 that are “less liquid, which means they may take longer to source in the required amounts.” For scale, 10% of $6.3B is around $630M of illiquid long-tail tokens to buy without moving the price.

Binance says it took a new asset snapshot at 00:00 GMT Saturday, and holders of those 10 tokens will be able to verify 1:1 backing once the full proof of reserves is published. It hasn’t given a date.

Washington

Asked about it Saturday, President Trump said “we’re learning about it” and that his administration would “talk to North Korea about it” (CoinDesk). The midterms are Tuesday. The CLARITY Act is still stuck in the Senate, and the biggest crypto theft ever is now a named North Korean state operation.

---

Why This Matters for Crypto Jobs

The FBI alert is effectively a job description. It lists the teams that have to act on it, and most of them don’t have enough people to do that well.

• Sanctions screening and transaction monitoring. Every VASP, bridge and swap service named in the alert now needs screening that follows funds derived from flagged addresses, not just exact matches. If you can build or tune taint-propagation rules, this is your week.
• On-chain investigators. “Thousands, becoming tens of thousands” of addresses means analytics firms, exchanges and stablecoin issuers need people who can cluster wallets faster than automated laundering generates them. Expect hiring at Chainalysis, TRM, Elliptic and in-house investigation teams.
• Protocol and infra compliance. RPC providers and THORChain node operators being named in a federal alert is new territory. Infra companies will need policy and legal people who can work out what “block transactions” means for a node operator, ideally before a subpoena does it for them.
• Treasury, OTC and market-making. Binance still has to buy roughly $630M of illiquid tokens quietly. Execution traders and OTC desks who can do that without moving the price are useful to every exchange that’s now stress-testing its own insurance fund.
• Exchange security. Two TraderTraitor heists, about $7.8B combined, both against exchanges whose signing flow was trusted. Signing-policy engineers, detection engineers and red teamers who think like a state-backed attacker are worth a lot right now.

---

Want to work in crypto security, compliance or on-chain intelligence? Browse thousands of open Web3 roles at Cryptogrind, updated daily.