FBI, Elliptic trace Binance $6.3B hack as funds move via scripts

The FBI confirmed North Korea's TraderTraitor group — a subunit of Lazarus Group — was behind the record $6.3 billion theft from Binance on Oct. 29, urging exchanges, DeFi services and analytics firms to block the laundering addresses. Binance reopened withdrawals on Nov. 1 after a 45-hour freeze and has since recorded $3.64 billion in net outflows — about 2.1% of its $171 billion in assets — absorbing the losses rather than passing them to users and replenishing roughly 95% of the stolen assets, while stablecoin issuers froze over $2.4 billion of the funds.

• Elliptic's tracking of the stolen funds found thousands of transfers, failed swaps and repeated transactions that suggest the hackers relied on scripts rather than AI agents to move money through thousands of wallets.
• Chainalysis expects attackers to spread funds across "tens of thousands" of addresses as tracing of roughly $3.3 billion continues; OKX and Bybit absorbed about $584 million of the outflow.