FBI names North Korea’s TraderTraitor for the Binance hack and asks THORNode operators to block addresses: a request, not an OFAC listing

The FBI said on Saturday 31 October that North Korea was behind the theft of “more than $6 billion” from Binance, naming the group it calls TraderTraitor about two days after the hack of 29 October. In the same notice it asked private crypto firms, THORNode operators among them, to block transactions linked to a list of addresses. The notice, issued with the US Secret Service and IRS Criminal Investigation, is a request. When we read the recent-actions page of the Treasury’s Office of Foreign Assets Control (OFAC) early on Sunday, it showed no action tied to the hack.

FBI Cyber Branch posted the advisory on X at 22:36:58 GMT on Saturday, according to securities.io. The post says North Korea “was responsible for the theft of more than $6 billion USD in virtual assets” from the exchange on or about 29 October, and links to the address list on the FBI site.

The text of that post is what we read directly. The FBI page itself refused our connection, so the list stayed out of reach: the address counts below are CoinDesk’s, and none of the listed addresses was checked on a block explorer. The theft itself is covered in our running piece on the Binance hack; this one deals with the FBI’s move and what it can do.

What the FBI Binance hack notice says about North Korea’s addresses

The FBI’s name for the activity is TraderTraitor, the label it also used for the Bybit theft in February 2025. CoinDesk describes the group as a subunit of the Lazarus Group, while Reuters calls it a North Korean state-sponsored unit. The term goes back to a joint US government advisory of April 2022, AA22-108A, on trojans dressed up as crypto trading software, ChainCatcher notes.

Two observations come with the attribution. The FBI, the Secret Service and IRS Criminal Investigation have seen the hackers convert stolen assets “primarily into Ethereum”, and they expect further laundering through DeFi and instant blockchain, where users swap tokens directly from their own wallets without handing custody of their funds to a company.">swap services. That second line explains who the request is aimed at.

The three agencies are “urging” private-sector firms to block transactions with or derived from addresses the group is using to launder the money. The post lists THORNode operators first, then RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers. Anyone with information is asked to contact a local FBI field office or ic3.gov, securities.io reports, adding that the FBI says it is committed to “identifying, mitigating, and disrupting North Korea’s illicit cybercrime and virtual asset theft activities”.

CoinDesk, which read the list, reports over 600 Ethereum addresses, just under 20 bitcoin addresses and a single Solana address. Reuters, Newsweek and securities.io give no number.

Securities.io and CoinDesk both describe addresses that hold or have held stolen assets, so a listed address may already be empty. Elliptic, for its part, counts 19 bitcoin addresses holding the stolen BTC, which matches the “just under 20” in CoinDesk. Matching is all we can say, since we could not compare the two lists.

The list is also a snapshot of a moving target. Jonathan Levin, chief executive of Chainalysis, told CoinDesk the attackers have already used “thousands of addresses” and that he expects “tens of thousands over the coming weeks”. Elliptic’s own free blocklist for this theft holds more than 1,000 addresses.

Pyongyang has for years denied using state-linked cyber units for espionage or financial theft, Reuters notes, and North Korea’s mission in Geneva and its embassy in China did not respond to the agency. President Trump, asked by a White House reporter on Saturday, said “we’re learning about it” and that his administration would “talk to North Korea about it”, according to CoinDesk. That follows his “We don’t know” of Friday.

A request to block, not an OFAC listing

An FBI notice tells the industry what the bureau knows and what it wants. An OFAC listing is a legal measure. When OFAC listed the Ronin getaway address on 14 April 2022, Elliptic described the effect, in The Record, as barring “US persons and entities from transacting with this address”.

OFAC does list wallets when it chooses to. On 28 October, the day before the Binance theft, it sanctioned a North Korean IT worker network along with eight wallets. That action predates the hack and has nothing to do with it. The latest item on OFAC’s recent-actions page when we read it at about 05:50 UTC on Sunday, dated 29 October, is an amended Iran-related general licence. A search for coverage of an OFAC move on the Binance addresses found none either.

OFAC sanctioned the Lazarus Group itself on 13 September 2019 under Executive Order 13722, Treasury has said. What that means for a firm handling these particular addresses is a question for lawyers, and none of the sources we read answers it about this notice. The post mentions no penalty for ignoring the request, and neither does the coverage we read, though we have not seen the FBI page. Equally, no source says that a retail user who unknowingly receives coins from a listed address is liable for anything, and we do not suggest it.

Courts have not settled the wider argument about software that nobody controls. US sanctions on the mixer Tornado Cash were lifted in March 2025 after a court overturned them. Its co-founder Roman Storm was convicted on one count in August 2025 while the jury deadlocked on two others, including conspiracy to violate sanctions. His retrial is set for 26 April 2027, The Block reported in August, with his motion for acquittal still undecided at that point.

In Europe the picture is thinner. The EU listed Chosun Expo in July 2020, the first use of its cyber sanctions framework, in hedged terms that tied the company to APT38 and the Lazarus Group, press reports said at the time. Whether a European service that processes North Korean funds breaches EU sanctions is not established by anything we read. We found no statement on the FBI notice from ESMA, the EBA, France’s AMF, or Italy’s Consob or OAM.

Two days, not five: how fast the US has named North Korea

The speed is new. TRM Labs dates the first transfers to 20:05 UTC on 29 October, so the FBI post came about 50 hours later. For Bybit, the same step took five days. For Ronin, Harmony and DMM Bitcoin it took weeks or months, as the table shows. The Harmony attribution came on 23 January 2023, seven months after a theft of $100 million.

The two most recent notices are built alike. The Bybit notice of 26 February 2025, which we could read in full on ic3.gov, encouraged firms to “block transactions with or derived from addresses TraderTraitor actors are using”. This time the verb is “urging”. Its list of recipients ran through RPC node operators, exchanges, bridges, blockchain analytics firms, DeFi services and other providers. It did not name THORChain or THORNode operators, even though THORChain went on to carry much of that money. The new notice names them first. This list is also far longer: 51 addresses then, against more than 600 Ethereum addresses alone now by CoinDesk’s count.

Private firms still moved first. TRM’s report, dated 29 October with on-chain data to 00:30 UTC on the 30th, attributed the theft with high confidence. Chainalysis spoke of a “high degree of confidence”, cryptonews.net reports. Elliptic had called TraderTraitor the likely culprit and updated its page at 23:55 UTC on Saturday, after the FBI spoke. None of the sources explains why the FBI was faster this time.

Who can actually block North Korea’s addresses

A blocklist works only where somebody has the power to act on it. The Binance theft has already sorted the parties into three groups, and an FBI request adds little for the first and nothing for the second.

The first group can freeze outright: stablecoin issuers and, on some networks, governance bodies. Elliptic has verified $2.85 billion frozen or seized, 44% of the $6.43 billion it counts, almost all of it USDT and USDC, in data from about 04:30 UTC on 31 October. The other tallies are older or narrower. TRM says about $2.7 billion as of 00:30 UTC on 30 October, Binance gave $3 billion that same night, per Cointelegraph’s live blog, and CoinDesk reports over $2.4 billion frozen by stablecoin issuers alone. Elliptic says Arbitrum and Optimism are the only chains where everything stolen has been secured, both through governance, and that Tether has begun blacklisting some receiving addresses on Tron.

The second group is the assets themselves. Bitcoin, ether and XRP have no issuer to ask. Nothing stolen on Bitcoin, the XRP Ledger, Solana or NEAR has been frozen, Elliptic reports, because “native assets have no issuer that can freeze them”. It puts what the attacker controls beyond any issuer’s reach at about $3.21 billion at 31 October prices, including 519,104 ETH and 18,270 BTC. TRM’s earlier count, from 30 October, is more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion. Elliptic also says none of the bitcoin had reached a service when it last updated.

The third group is where the FBI’s request lands: the services that coins must pass through to become spendable. Exchanges, instant swappers, bridges and node operators cannot seize anything from a wallet the attacker controls, but they can refuse the flow, and the list gives them something to match against. Analytics firms label addresses and leave the blocking to their customers. Elliptic says its alerts have already led to freezes of some of the stolen funds, and that more than $3 billion can now only be stopped when it reaches an exchange or other service.

All of this is voluntary, and the record of the last request is thin. We found no figures on how many firms acted on the 51 Bybit addresses, or on how many of those addresses were blocked.

THORChain is the test of the FBI’s request

THORChain lets users swap native coins across chains, such as ether for bitcoin, without a central operator. Its swaps are run by node operators, the THORNode operators of the FBI notice. The record explains why they are named: ZachXBT said on 30 October, via Cointelegraph’s live blog, that stolen Binance and Bitget funds were commingled at one address after arriving through THORChain.

Bybit showed how this can go. About 100 volunteer operators ran the network at the time and a majority had to agree on any action, DL News reported in March 2025. On 26 February 2025, the day of the FBI notice, some operators paused Ethereum trading and others reversed it within 30 minutes, an unnamed developer told the outlet. Lazarus then laundered about $900 million through THORChain over the following week, by the analysis of researcher Taylor Monahan, and operators who kept running earned about $5.5 million from those transactions.

John-Paul Thorbjornsen, from the original developer team, told DL News then that operators were not worried about legal action and could run a patch to filter out sanctioned addresses. He also said that stopping Lazarus would have meant halting the whole network, with no swaps at all. Two limits apply to the patch. The article did not say how widely it was deployed, and a filter for sanctioned addresses would not obviously cover a list that OFAC has not sanctioned. Lawyer Yuriy Brisov of D&A Partners told DL News that the network’s “decentralised nature does not fully insulate it from the legal ramifications”. The same article found no sign of an investigation of THORChain or its operators, many of whom it described as publicly known and based in the US.

So far the answer from THORChain has been about data. Co-founder Chad Barraford said THORNode operators hold nothing beyond what is public and available in real time, and that law enforcement can obtain it without a subpoena, TokenPost reported late on 31 October, US time, without quoting him. He did not say whether operators will block these addresses.

There is a complication this weekend. THORChain swaps are already paused for a separate reported reason. Crypto Briefing said on 31 October that an Ethereum reorganisation led the network to refund the same 10 ETH deposit twice, setting off an emergency pause on 12 of 13 chains. The THORNode API still showed trading halted on 11 of 13 when we read it at 05:56 UTC on Sunday. THORChain has not confirmed that account, and Crypto Briefing itself says the trigger was the refund error, not a move against stolen funds. We found no sign that the pause answers the FBI, and it says nothing about what operators will do once swaps return.

What to watch after the FBI notice

The first thing is OFAC. In 2022 the attribution came with a listing on 14 April, three more Ethereum addresses followed on 22 April, and on 6 May Treasury added four more wallets and sanctioned the bitcoin mixer Blender.io, a sequence of 8 and then 22 days. Nothing shows that this sequence will repeat. If it did, the request would become a legal measure for US persons.

The second is whether THORNode operators say or do anything when swaps resume, and whether instant exchanges disclose any blocks. The third is the list itself: with Chainalysis expecting tens of thousands of addresses, an FBI list of a few hundred will fall behind unless it is updated, and no update has been announced in the coverage we read.

Elliptic’s 19 bitcoin addresses are the plainest marker. None had touched a service at its last update, and most hold 1,000 BTC each, so a move should be easy to see.