TL;DR: The FBI, the Secret Service, and IRS Criminal Investigation put out a joint statement late Saturday formally pinning the $6.4 billion Binance hack on North Korea’s TraderTraitor hacking group and handed the crypto industry a list of more than 600 wallet addresses to block. Asked about the hack by a reporter, President Trump said he was “still learning about it” and that his administration would “talk to North Korea about it.”
From private attribution to an official government case
Up to this point, everyone pointing a finger at North Korea over the Binance hack has been a private company. TRM Labs called it first, as we covered when the heist crossed the confirmed $6.36 billion mark. Chainalysis backed that up. Now the US government has put its own name on it, and that changes what happens next.
In a joint statement issued Saturday, the FBI, the US Secret Service, and IRS Criminal Investigation said the hack was carried out by TraderTraitor, a subunit of North Korea’s Lazarus Group that has spent years specializing in draining crypto exchanges and laundering the proceeds through a maze of swaps, mixers, and decentralized finance protocols. The same cluster was blamed for the $1.5 billion Bybit theft that, until three days ago, held the record for the largest crypto hack ever.
The three agencies didn’t just issue a statement. They published a list of wallet addresses tied to the laundering effort, more than 600 Ethereum addresses, just under 20 Bitcoin addresses, and a single Solana address, and asked a specific group of companies to block any transaction touching them: THORNode operators, RPC node operators, instant exchanges, DeFi protocols, blockchain analytics firms, and other virtual asset service providers.
A heist that keeps outrunning the response
Binance said last week that it had replaced 90 percent of the roughly $6.3 billion stolen and was aiming to reopen customer withdrawals this Sunday. Stablecoin issuers have already frozen more than $2.4 billion tied to the attackers, which sounds like a win until you hear what Chainalysis CEO Jonathan Levin told reporters: attackers have already pushed stolen funds through thousands of addresses, and his firm expects tens of thousands more to show up over the coming weeks as the laundering spreads.
That’s the uncomfortable math behind a blocklist like this one. Six hundred addresses is a snapshot, not a perimeter. North Korean state hackers have been doing this long enough to know that the moment a list goes public, they rotate. Fresh wallets, fresh mixers, fresh chains to bounce through. The FBI’s own statement acknowledges the attackers are expected to keep using swap services and DeFi tools specifically because those venues move fast and ask fewer questions than a centralized exchange would.
None of that makes the statement pointless. It gives compliance teams at exchanges and stablecoin issuers a concrete list to screen against today, not next month, and it puts an official US government seal on an attribution that sanctions enforcement, insurance claims, and future indictments will all lean on. A private firm’s blockchain analysis is useful. A joint FBI, Secret Service, and IRS-CI statement is something prosecutors can actually cite.
Trump’s answer says more about the moment than the hack
A reporter asked Trump about the Binance hack over the weekend, and his response, “we’re learning about it,” landed almost a week after the exploit first hit headlines and three days after TRM Labs had already named North Korea as the culprit. He added that his administration would “talk to North Korea about it,” without offering anything closer to a policy response.
That gap between what blockchain investigators already knew and what the White House was prepared to say out loud is worth sitting with. North Korea has used crypto theft to fund its weapons programs for years, Lazarus Group alone is estimated to have stolen billions through exchange hacks since 2017, and the playbook rarely changes: breach a hot wallet or a signing process, move the funds fast, launder through as many hops as possible before anyone can freeze them. The Bybit heist earlier in 2025 followed the same shape. So did this one.
What actually changes from here
The real test isn’t the statement itself, it’s what the named recipients do with it. THORChain and similar cross-chain swap networks have been the preferred laundering route in past North Korean heists precisely because they don’t require the kind of identity checks a regulated exchange does. If THORNode operators actually start blocking the listed addresses at the protocol level, that closes one of the easiest paths out. If they don’t, or if the volume is too high to screen manually, the blocklist becomes a press release more than a defense.
There’s also the open question of what, if anything, Washington does beyond naming names. Sanctions through the Treasury’s OFAC list are the obvious next step, and they’d give the blocklist real teeth by making it illegal for US-linked entities to touch those addresses. Nothing in this weekend’s statement indicates that’s coming yet, which is probably why Trump’s comment landed as noncommittal as it did.
The bottom line
Official attribution matters, and having the FBI, Secret Service, and IRS-CI put their names on North Korea’s role turns a blockchain-analytics theory into a government finding that can actually drive enforcement. But a list of 600 addresses against a laundering operation that’s already touched thousands and is projected to touch tens of thousands more is a speed bump, not a wall. The real signal to watch isn’t this statement, it’s whether Treasury follows it with sanctions, and whether the swap networks and DeFi protocols named in the request actually start saying no.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
