Choose a section or paragraph
The FBI has released 628 cryptocurrency addresses associated with the theft of more than $6 billion from Binance, giving investigators and blockchain companies a new set of leads for tracking stolen assets. The disclosure also raises a critical question: how much of the cryptocurrency remains accessible to the attackers, and how much can realistically be recovered?
The investigation into Binance’s October 29 security breach entered a new phase after the US Federal Bureau of Investigation publicly attributed the attack to TraderTraitor, a hacking operation associated with North Korea.
In an October 31 advisory, the FBI released hundreds of wallet addresses that it said were operated by or closely connected to the attackers. The agency also warned cryptocurrency service providers that stolen assets were being converted primarily into Ether and could move through decentralized finance platforms and instant cryptocurrency exchanges.
Blockchain intelligence company TRM Labs estimates that approximately $6.36 billion was stolen across ten blockchain networks, making the incident the largest known cryptocurrency theft by dollar value.
But the movement of stolen cryptocurrency is not the same as its disappearance.
Public blockchain transactions can be examined, and many transfers remain permanently visible. The difficulty lies in establishing who controls each address, whether the funds have moved through intermediaries, and whether they can be frozen or recovered.
The FBI’s newly published address list provides a starting point. It does not, by itself, establish the current balance of every listed wallet or identify the ultimate destination of the entire $6.36 billion.
What Exactly Did the FBI Reveal?
The FBI advisory, titled North Korea Responsible for $6 Billion+ Binance Attack, was published on October 31, two days after the theft.
The agency said its investigation, conducted alongside the US Secret Service and IRS Criminal Investigation, identified activity involving the movement and conversion of stolen cryptocurrency.
The public address list contains 628 entries:
| Blockchain | Addresses published |
|---|---|
| Ethereum | 608 |
| Bitcoin | 19 |
| Solana | 1 |
| Total | 628 |
The large number of Ethereum addresses reflects the significance of Ether in the reported post-theft activity.
However, a greater number of addresses does not necessarily mean that Ethereum contains a larger amount of unrecovered funds today.
A single cryptocurrency holder can control hundreds of addresses, and funds may be transferred through multiple addresses during the same operation.
The FBI explicitly identifies the listed addresses as ones that hold or previously held stolen assets and are operated by, or closely associated with, TraderTraitor.
That wording matters. It means the list is a law-enforcement tracing and disruption resource, not a statement that all 628 addresses currently contain stolen cryptocurrency.
Which Ethereum Wallets Did the FBI Identify?
Among the Ethereum addresses publicly named by the FBI are the following:
0x8532FA14ACAf483729C449b8458aedDb900543D40xc887aF690E0301CD4edBbCe8F8d31b4EC65B286A0x897C80d1a9729E94460e2Bd93178bD5215158DF30x54401f80Da97893a15D43566184635B6674BC9420x79e70d139fC05AA75F75611fDF2680E9952B544A0x03b0eE5d82990cFF1bDa48651AC3e436d1a020ea0x294828705974AD04d86A24a2ff6eFe762505A0Ed0xa0b35142e3409e73d23bc893a17D35e156baAcb3
These addresses appear in the FBI’s official advisory and can be inspected using public Ethereum blockchain explorers.
Their inclusion establishes that they are part of the agency’s identified network of addresses associated with the theft.
It does not necessarily establish how much cryptocurrency each address holds on November 2.
That would require checking current balances, ERC-20 token holdings, transaction histories, internal transfers and relevant smart-contract interactions at a specified block height.
An address that received stolen ETH on October 29 may have transferred some or all of it elsewhere by the time an investigator examines it.
A reliable tracing report must therefore record transaction timestamps and distinguish historical receipts from current holdings.
What Happened to the 18,270 Stolen Bitcoin?
Bitcoin represents one of the largest components of the theft.
TRM Labs reported that approximately 18,270 BTC, valued at around $1.47 billion at the time of the incident, was removed from Binance-controlled wallets.
According to its initial investigation, the stolen Bitcoin began moving through a sequence of transactions in which large holdings were divided into smaller outputs.
This process is sometimes described as a peel chain.
Rather than sending an entire balance directly to one destination, a series of transactions can repeatedly divide funds between new addresses.
The technique complicates analysis because investigators must follow individual transaction outputs and account for change addresses.
The FBI’s address list includes 19 Bitcoin addresses associated with the operation.
For example:
bc1qxrxujwxfnvz040jw76d26zhjdg5jura7hs968sbc1qepc70u3u476vgvg3hfcwjgu4mecxe2uchs4lagbc1qdfhmlrdvg4tm87zjl0vyf0xflp5ql50q3g88gwbc1qnq6jj9jmlf3945m3l8s0kxnqehrsga300k8t3s
Bitcoin’s blockchain provides a permanent history of confirmed transactions, but the identity of a wallet controller is not automatically visible.
Even when funds arrive at an address associated with a trading platform, further evidence may be required to determine whether the transaction represents a deposit, an internal transfer or movement through a third-party service.
TRM’s initial report described the attacker controlling the stolen Bitcoin after the theft. That finding should not be interpreted as a live balance confirmation for November 2.
The Solana Wallet Named by the FBI
The FBI also published one Solana address:
AffzFDKZbyMiU11zmVBoAqD25ugpr7xoWWyRyGigBEaU
TRM Labs previously estimated that approximately 970,500 SOL, valued at around $96 million at the time of the theft, left Binance-controlled wallets.
The FBI’s inclusion of a Solana address provides a public starting point for examining activity on that network.
Solana transaction analysis differs from Ethereum and Bitcoin because token accounts, program interactions and address ownership must be interpreted within Solana’s account model.
An investigator examining the named wallet would need to distinguish native SOL movements from transfers involving SPL tokens and other associated accounts.
The public FBI disclosure does not establish that the listed address currently holds all of the SOL originally stolen.
How the Attackers Converted Stablecoins Into Ether
One of the most important findings comes from the blockchain activity identified by TRM Labs during the early stages of the theft.
Rather than simply storing the stolen stablecoins, the attackers reportedly attempted to convert a portion into native cryptocurrency.
TRM described approximately $325 million in stolen USDT being sold through decentralized exchange and market-making infrastructure in exchange for roughly 122,300 ETH.
The firm also identified an operation involving approximately $60 million in USDT deposited into the Aave lending protocol, with around 19,760 ETH borrowed against it.
These transactions illustrate why laundering activity does not always involve sending stolen assets directly to a centralized cryptocurrency exchange.
Decentralized trading and lending services can be used to change the composition of assets without relying on a conventional exchange order book.
The movements also help explain why Ether became central to the FBI’s warning.
Unlike centrally issued stablecoins, native ETH does not have an issuer that can freeze a particular wallet’s balance.
It remains possible to track transactions, but restricting the movement of native cryptocurrency generally requires a different form of intervention.
How Much of the $6.3 Billion Was Frozen?
The response to the incident involved several major stablecoin issuers and blockchain organizations.
According to TRM Labs, Tether, Circle, Ripple and World Liberty Financial froze approximately $2.67 billion in affected stablecoins.
The Arbitrum Security Council also intervened, restricting access to 8,426 ETH and approximately 74.6 million ARB associated with the attack.
Together, the actions represented roughly $2.7 billion in frozen or restricted assets during the initial response.
These interventions were substantial, but they should not be confused with the return of cash or cryptocurrency to Binance.
A frozen token may remain at an attacker-associated address while its transferability is restricted.
Actual recovery can require additional steps, including legal proceedings, issuer cooperation or protocol-specific procedures.
Furthermore, the quoted figures refer to the initial investigative period. They should not be presented as an independently audited November 2 recovery total.
Why Some Stolen Cryptocurrency Is Harder to Recover
The difference between centrally issued stablecoins and native cryptocurrencies has become one of the defining features of this case.
USDT and USDC operate through token contracts that include issuer-controlled mechanisms for restricting certain addresses.
Bitcoin, by contrast, does not have a central issuer capable of disabling a wallet.
Native Ether operates under a similar principle.
A blockchain explorer can reveal that cryptocurrency reached a particular address, but it cannot independently force the address controller to return the assets.
Law enforcement may still recover cryptocurrency when private keys are obtained, custodial service providers cooperate, or other legal and technical mechanisms become available.
However, the mere identification of an address does not guarantee a successful recovery.
That is why the publication of the FBI’s 628-address list is important for financial intelligence and transaction monitoring, even though it does not mean the agency has seized those wallets.
What Does the Evidence Say About North Korea?
The FBI publicly attributed the Binance theft to TraderTraitor, a North Korean state-sponsored cyber operation, on October 31.
TRM Labs had reached the same attribution earlier, citing a combination of blockchain activity and off-chain intelligence.
The forensic firm pointed to similarities with previous attacks, including advance preparation, suspicious transaction patterns and the movement of funds through newly established addresses.
It also described small Tornado Cash withdrawals used to fund an operator wallet before the theft.
These details may help investigators identify operational relationships between incidents.
However, blockchain transactions alone do not necessarily prove the real-world identity or nationality of the individuals controlling a wallet.
The FBI’s attribution carries the weight of a formal US law-enforcement assessment. The full underlying intelligence has not been disclosed publicly.
Importantly, the evidence reviewed for this article does not establish that Binance executives intentionally assisted the attackers or knowingly facilitated transfers to North Korea.
Such an allegation would require separate, credible evidence.
What the FBI Wants Crypto Companies to Do
The FBI’s warning extends beyond cryptocurrency exchanges.
The agency specifically urged blockchain infrastructure operators, decentralized finance services, instant exchange providers, analytics companies and other virtual asset businesses to help prevent further movement of the stolen assets.
The request reflects the way blockchain transactions can pass through different services without a traditional financial institution being involved in every transfer.
For compliance teams, the published addresses provide indicators that can be compared against customer transactions and blockchain activity.
But the FBI’s list should not be interpreted as a finding that every address receiving a payment from a listed wallet is controlled by TraderTraitor.
Transaction relationships require contextual analysis.
Service operators must also account for the risk of inaccurate attribution, indirect exposure and unrelated users whose funds may pass through shared infrastructure.
What Remains Unknown About the Stolen Funds?
Despite the large number of published addresses and the detailed findings from blockchain intelligence companies, several important questions remain unanswered.
The first concerns current holdings. There is no independently established November 2 balance for every address on the FBI list in the evidence reviewed for this report.
The second involves onward transfers. Some assets were converted or redistributed during the initial attack, but the complete subsequent movement of every stolen token has not been established here.
Third, the relationship between frozen assets, located funds, recovered cryptocurrency and Binance’s customer reimbursements requires careful accounting.
Binance has reported replenishing most affected customer assets using its own resources. That is an important customer-protection measure, but it does not mean an equivalent amount was taken back from the attackers.
Finally, the precise mechanism through which the attackers gained authorization to move assets across multiple networks still requires a complete technical explanation.
TRM’s analysis points to a compromise involving Binance’s transaction-signing infrastructure, including the abuse of Ethereum’s EIP-7702 authorization mechanism.
A definitive account of the initial intrusion and all affected systems would require additional internal evidence.
Cryptopian News Analysis: The Wallet List Is Evidence, Not the End of the Trail
The FBI’s disclosure is one of the most significant public developments in the investigation because it allows security researchers, financial institutions and independent analysts to examine a defined collection of addresses.
It creates opportunities for transaction screening, historical reconstruction and identifying additional movements.
But it is important to understand what the list establishes.
The addresses are linked to the incident according to the FBI. They are not necessarily 628 separate individuals, 628 active wallets with positive balances or 628 locations where stolen funds remain today.
The strongest evidence available shows that the attackers moved billions of dollars across multiple networks, converted portions of the stolen assets, and encountered significant restrictions when stablecoin issuers intervened.
Substantial Bitcoin and Ether holdings were also identified during the initial investigation, making continued tracking of those assets particularly important.
The remaining work is to reconcile historical transactions with present balances and determine whether subsequent movements lead to identifiable intermediaries or recovery opportunities.
For cryptocurrency users, the case illustrates that blockchain transparency provides valuable forensic evidence, but does not automatically prevent theft or guarantee restitution.
For exchanges, it raises deeper questions about transaction authorization, operational security and the independence of systems responsible for protecting customer assets.
And for investigators, the FBI’s 628-address disclosure provides a substantial new body of evidence to examine.
The trail is public in many places. The final destination of the stolen cryptocurrency is not yet fully established.
FBI-Listed Wallet Addresses
Explore a selected set of 28 addresses from the FBI's October 31, 2026 Binance theft advisory. These are 8 Ethereum, all 19 Bitcoin and 1 Solana address. For all 628 reported addresses, see the official FBI source ↗.
Showing 28 addresses
0x8532FA14ACAf483729C449b8458aedDb900543D40xc887aF690E0301CD4edBbCe8F8d31b4EC65B286A0x897C80d1a9729E94460e2Bd93178bD5215158DF30x54401f80Da97893a15D43566184635B6674BC9420x79e70d139fC05AA75F75611fDF2680E9952B544A0x03b0eE5d82990cFF1bDa48651AC3e436d1a020ea0x294828705974AD04d86A24a2ff6eFe762505A0Ed0xa0b35142e3409e73d23bc893a17D35e156baAcb3bc1qxrxujwxfnvz040jw76d26zhjdg5jura7hs968sbc1qepc70u3u476vgvg3hfcwjgu4mecxe2uchs4lagbc1qdfhmlrdvg4tm87zjl0vyf0xflp5ql50q3g88gwbc1qnq6jj9jmlf3945m3l8s0kxnqehrsga300k8t3sbc1q42flhayrzy3zh8lkyevw8qcjduurt9a35wlsyxbc1qz8hdwv8gmml0u96dsvnzsagz6krjyzxmgxupdpbc1qm2j6v3247khlwzxl7p9vqnfkghcllyhv9wjaatbc1q0ts8gaf9ht0rr4u02hr56f8thndqsc4kmkmfv3bc1q2wvz0kcsn4hqmajwtey30ud27fl25w8pveznn6bc1qalwnl7dtaa73fsq5tyn0ghfy3fgfpqkt69tca8bc1qjwdw6vrzq4vf6hckutvx4ucj86awwv99mxnz7wbc1qs3aej5tmcdz0vctz8y9rjcxtxg8v5385577s56bc1q63qrfrpsg5hh0zzn3kp2xx9vljl7dq7tatsjxpbc1qs6xnmhar38z44g2za93pv8ygdcwurrh8l87w3vbc1qg3nrzpuvq2pxqx74tcrywr09dc208ze96n3t53bc1qf5cyvv9w50tx9xx9s3xwsne0z87wvjj9l8a35ubc1qm8v88m5fy6kuq9myva2eemwycxqd3e0zcrs2l8bc1qrg025e2pgx0rwya2kpgtj30972p64jt0hn6zytbc1qxg0l4p6xc50zuv9cl5f0l0wmaxjpg8wcy7s9raAffzFDKZbyMiU11zmVBoAqD25ugpr7xoWWyRyGigBEaUNo matching wallet addresses.
Binance Replaces $6B After Hack: What Remains Missing
Editorial methodology: This report draws on the FBI’s October 31, 2026 advisory, TRM Labs’ October 29–30 blockchain investigations and additional published tracing research. The wallet addresses reproduced here were checked against the FBI’s published list. Cryptopian News has not independently audited the current balances of all 628 addresses or reproduced a complete transaction-level trace. All financial figures should be understood according to their original reporting timestamps. No claim of current attacker control is inferred solely from an address appearing in the FBI advisory.
Sources:
- FBI — North Korea Responsible for $6 Billion+ Binance Attack, October 31, 2026
- TRM Labs — Technical and blockchain forensic report, October 29
- TRM Labs — Broader North Korea cryptocurrency theft research, October 30
- Bitquery — Independent on-chain reconstruction, October 31
- Reuters — Timeline of the Binance theft
- FBI Identifies 628 Wallets in Binance’s $6.3 Billion Hack: Where Did the Stolen Crypto Go? - November 2, 2026
- Binance Replaces $6B After Hack: What Remains Missing - November 1, 2026
- South Korea’s Hanwha Partners With Chainlink to Bring Real-World Assets Across Blockchains - October 30, 2026