FBI Blames North Korea for $6.3B Binance Hack — Can DeFi Block the Wallets?

More than 600 wallets just landed on a US blocklist, and they all point to the same crime: the $6.3 billion Binance hack. The FBI has now named North Korea's TraderTraitor crew as the thieves behind it, and it wants exchanges, DeFi apps and node runners to refuse their coins outright.

Key points:

• The FBI has pinned the $6.3 billion Binance theft on North Korea's TraderTraitor crew, the same group tied to the Lazarus hacking outfit, and it has published a list of wallets tied to the loot.
• Over 600 Ethereum addresses made the list, along with just under 20 Bitcoin addresses and a single Solana address, and most of the stolen money is being swapped into Ether.
• Binance says it has already replaced 90% of what was taken and plans to reopen withdrawals on Sunday, but Chainalysis warns the laundering web could grow to tens of thousands of addresses in the next few weeks.

I read it this way: this is no longer just a Binance problem. Once the FBI names a crew and publishes its wallets, any platform that touches those coins has to choose, block them or risk looking like it helped wash the money. That choice is what makes this story bigger than the hack itself.

The FBI said on Saturday that TraderTraitor has been turning the stolen funds mostly into Ether, and it expects the crew to push the money through DeFi apps and instant swap services next. Along with the US Secret Service and IRS investigators, it asked THORNode runners, RPC node runners, instant exchanges, DeFi services, analytics firms and other crypto firms to block any trade that comes from, or traces back to, the listed wallets. Chainalysis says the crew has already used thousands of addresses, and it expects that count to hit tens of thousands in the coming weeks, since the thieves have too much money for their usual laundering routes to handle. The firm also says the crew is using new automated tools to blur the trail, moving coins between wallets before sending them on.

Read also: 12 DeFi Websites Hijacked in One Night, $138,000 Drained From Wallets

Can anyone actually freeze these coins?

Binance, for its part, says it has replaced 90% of the stolen crypto and plans to let customers withdraw again on Sunday. Stablecoin issuers have already frozen over $2.4 billion of the loot, which is why so much of what is left is being swapped into Ether, a coin no single company can freeze. On Saturday, US President Donald Trump was asked about the hack and said his team is learning about it and would talk to North Korea about it.

Watch two things next. First, whether big DeFi services and THORChain node runners actually block the listed wallets, since a blocklist only bites if the platforms enforce it. Second, whether the flood of new addresses makes the list hard to keep up with, because a wallet that looks clean today could sit one hop away from stolen coins tomorrow. For traders, the plain risk is touching tainted coins without knowing it, so check twice before taking in funds from a stranger, and keep your own coins on a wallet you control.

Read also: Nomad $186M Hack Suspect Extradited to US — Will He Face 20 Years?

— BitByLine News Desk

This one is news, not advice about money. BitByLine does not tell you to buy or sell anything, and any call you make with your own money is yours alone, with the risk yours too, so check things yourself first. Read our full Disclaimer.

Sources: CoinDesk, Cointelegraph