FBI Links $6 Billion Binance Hack to North Korea, Flags Solana Address for Blocking
U.S. authorities identified hundreds of addresses tied to the Binance theft and urged DeFi infrastructure providers to block transactions as laundering activity expands across chains and services.
The FBI confirmed that North Korea’s TraderTraitor hacking group was behind last week’s theft of more than $6 billion from Binance, and urged crypto infrastructure providers to block transactions connected to the stolen funds. The notice included hundreds of Ethereum addresses, nearly 20 Bitcoin addresses and one Solana address.
FBI Calls for Industry-Wide Blocking
The FBI said the attackers have primarily converted the stolen assets into Ether (ETH) and are expected to use swap services and decentralized finance tools to continue laundering the proceeds. The request extends beyond centralized exchanges to much of the infrastructure that enables on-chain transactions.
The agencies called on several categories of private-sector firms to act, including:
- THORNode and RPC node operators
- Instant exchanges and other swap services
- DeFi protocols and virtual asset service providers
- Blockchain analytics companies
- Stablecoin issuers and related infrastructure providers
The FBI, alongside the U.S. Secret Service and IRS Criminal Investigation, asked these entities to block transactions originating from or derived from addresses associated with the TraderTraitor laundering operation. The request places additional pressure on permissionless services to identify and restrict funds as they move through multiple chains and intermediaries.
Laundering Network Expected to Expand
The FBI listed more than 600 Ethereum addresses, just under 20 Bitcoin addresses and a single Solana address in its Saturday notice. The relatively small number of Solana addresses does not indicate that Solana infrastructure is outside the scope of the response; it reflects the address set identified in the specific notice.
Chainalysis CEO Jonathan Levin said the attackers had already used “thousands of addresses,” despite the FBI’s initial list. He expects the network to grow to tens of thousands of addresses in the coming weeks as the stolen assets move through a wider group of services.
Levin said the scale of the haul could exceed the capacity of the hackers’ established laundering venues. Funds may therefore spread across bridges, instant exchanges and swappers, creating a more fragmented monitoring challenge for exchanges, node operators and DeFi teams.
Stablecoin issuers have already frozen more than $2.4 billion of the stolen funds. Binance said it had replenished 90% of the stolen cryptocurrencies and planned to resume customer withdrawals on Sunday.
What This Means
For Solana, the FBI’s inclusion of one address highlights the network’s role in cross-chain investigations even though most of the identified activity was tied to Ethereum. DeFi protocols, RPC providers and swap services may face stronger expectations to screen wallets and transaction paths linked to sanctioned or stolen assets.
The incident also underscores a tension between rapid, permissionless settlement and coordinated financial-crime response. As the laundering network expands, legitimate users could see stricter screening, delayed transactions or blocked funds, while analytics firms and infrastructure providers become increasingly central to preserving trust across the crypto market.