The FBI names the Binance attackers and asks the exit routes to act.

In an alert dated 31 October, the FBI attributed the theft of more than $6 billion from Binance to North Korea's TraderTraitor activity. It published wallet addresses and asked crypto infrastructure operators to block transactions linked to the stolen funds.

The agency says it and partners at the US Secret Service and IRS Criminal Investigation observed stolen assets being converted mainly into ether. It expects further laundering through decentralised finance and instant-swap services. Its request names node operators, exchanges, analytics firms and other service providers: the action sought is disruption along the routes the funds may take.

This is a new official attribution and intervention request, separate from Binance's announcements about replacing customer assets and reopening withdrawals. It does not establish that every listed balance has been frozen or that the stolen funds have been returned. A published address list is an investigative tool, not a recovery receipt.

Independent reporting by Yonhap and CoinDesk corroborates the alert. CoinDesk also reports Chainalysis's assessment that the attackers have already used thousands of addresses and may spread the proceeds through many more. That assessment explains why a list is only one part of the response; it is not a count of recovered assets. Readers should use the original FBI notice for its address list and reporting channels rather than treating a circulating screenshot as the complete advisory.