On Saturday, October 31, the FBI said North Korea was responsible for the theft of roughly $6 billion from Binance two days earlier. According to CoinDesk’s report of the statement, the bureau blamed TraderTraitor, a unit of the Lazarus Group, and asked a long list of crypto companies to block any transaction involving the thieves’ addresses. Stablecoin issuers had by then frozen more than $2.4 billion.

The attribution is the expected part. The request is the interesting one: it asks services that describe themselves as neutral, such as decentralized exchanges, node operators and swap protocols, to refuse certain users. This piece covers what happened, who has complied, what legal force the request carries, and why the argument is bigger than one hack. We could not retrieve the FBI’s own page, so FBI details here come from CoinDesk, CryptoSlate and other outlets that reported on it.

What happened at Binance

Binance’s hot wallets were drained across about ten blockchains on Thursday, October 29, with most of the outflow taking roughly 20 minutes, according to blockchain analytics firm TRM Labs. Binance estimates the loss at about $6.3 billion. TRM puts it at about $6.36 billion at the prices prevailing when each transfer happened, or about $6.23 billion at prices from the next morning, and Chainalysis says about $6.4 billion. TRM calls it the largest crypto hack on record; the previous largest was the roughly $1.5 billion Bybit theft in February 2025, which the FBI also pinned on North Korea.

TRM’s breakdown shows about $3.79 billion on Ethereum, including 200,630 ETH and about $2.7 billion in Tether and Circle stablecoins, plus 18,270 bitcoin worth about $1.47 billion and about $628 million on Tron, with the rest on the XRP Ledger, Solana and other chains. Both TRM and Chainalysis say the Ethereum theft used a feature called EIP-7702, which lets a wallet temporarily run another party’s code, with signed authorizations submitted from a wallet funded through the mixer Tornado Cash. TRM says preparation began at least 36 hours earlier and likely involved compromised signing infrastructure. Binance first pointed to a compromised engineer’s laptop, then cited additional points of breach, and reported no evidence that private keys leaked. It has not published a root cause. Binance reopened withdrawals on November 1 and says it has replaced about 90% of the stolen assets. For earlier cases in this pattern, see our report on the Bitget hack and our look at 2026’s hack trend.

What the FBI asked for

As CoinDesk reports, the FBI, working with the Secret Service and IRS Criminal Investigation, listed more than 600 Ethereum addresses, just under 20 bitcoin addresses and one Solana address. Another outlet counted 608, 19 and one. It asked THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions with those addresses or with funds derived from them. CryptoSlate reports the FBI expects the attackers to convert mainly to ether and to use swap and DeFi tools. Some listed addresses may no longer hold funds, and Chainalysis says the attackers have already used thousands of addresses and expects far more, so a static list can only go so far.

The freezes, and what $2.4 billion means

Stablecoins are the part of the system that can be stopped. Tether’s chief executive said it froze more than $1.567 billion in USDT and Circle’s said it froze more than $800 million in USDC, which together come to about $2.37 billion; TRM’s Ari Redbord described the combined freeze as about $2.4 billion within an hour. Ripple, World Liberty Financial and the Arbitrum Security Council also froze assets. Across all issuers and protocols, TRM counts about $2.7 billion frozen, Chainalysis about $2.8 billion and Binance about $3 billion. Frozen is not recovered: Redbord described the path from freeze to recovery as a seizure warrant followed by civil forfeiture. Meanwhile TRM says the attacker still held more than 420,000 ETH and 18,270 bitcoin, about $2.4 billion, on October 30. Freezes are a useful reminder of what stablecoins are: tokens whose issuers keep the ability to block them. Bitcoin and ether have no such switch, which is why the FBI’s request is aimed at the services that move them.

A request, not an order

Every account we read describes the FBI action as a request or alert. None cites a court order, a subpoena or a Treasury sanctions designation, and we found no OFAC action tied to this theft. The legal backdrop is unsettled. OFAC delisted Tornado Cash in March 2025 after the Fifth Circuit ruled its immutable smart contracts could not be sanctioned as property, and its developer Roman Storm was convicted in August 2025 on one count of conspiring to operate an unlicensed money-transmitting business, with the jury deadlocked on the other two; a post-trial motion is pending and a retrial is set for April 2027. A voluntary request therefore sits in a gap: companies that comply may be acting well within the law, while those that decline are not obviously breaking it.

Who has said yes, and who has not

Centralized issuers and exchanges are the easy cases, because they already screen and freeze under their own terms. The harder cases are protocols with no operator. CryptoSlate reports that THORChain co-founder Chad Barraford said node operators see only public data, and that the network declined to block funds from the Bitget hack in September; its emergency pause during this incident was attributed to an unrelated Ethereum reorganization rather than to the FBI’s request. Aave paused affected markets, according to TRM, while about $325 million in USDT was sold through UniswapX at a discount and funds moved through Aave and Tron’s JustLend, with Chainalysis noting Tron lending protocols being used to get around stablecoin freezes. We did not retrieve current responses from mixers, validators or front-end operators.

The argument underneath

One side says cooperation is the price of adoption: if DeFi wants to be taken seriously as financial infrastructure, it cannot also be the laundering route for a state weapons program, and refusing invites broader regulation. The other side says that once a protocol blocks addresses on a government list it becomes a chokepoint, and that the list can grow beyond hackers. Neither side is wrong on the facts. What is new is the scale, since $6 billion makes the request hard to dismiss, and the target, since the request runs to node operators and swap routers rather than to companies with compliance departments. For background on the mixer at the center of the earlier cases, see our glossary entry.

What we could not confirm

We could not read the FBI’s statement, so the exact address counts, wording and whether the Bitcoin and Solana lists carry the same block request come from press coverage. Loss figures range from $6.23 billion to about $6.4 billion depending on the pricing date, and Tether’s freeze figure has been reported at several different amounts. Whether the request was aimed at DeFi in general or mainly at THORChain is unclear from the headlines, and Binance has not published how the keys or signing systems were compromised.

Why it matters

The Binance theft is a security story and a policy story at once. For users, the practical lesson is that centralized exchanges remain single points of failure even at Binance’s scale. For the industry, the FBI’s request is an early test of how much cooperation neutral infrastructure will accept without a law requiring it. Watch for the first freeze-to-forfeiture cases, any sanctions designation that would turn a request into an obligation, Binance’s root-cause report, and how many protocols quietly comply. This is reporting, not legal or investment advice.

Further reading

Frequently asked

Who does the FBI say hacked Binance?

According to CoinDesk’s report of the FBI’s October 31 statement, North Korea’s TraderTraitor group, described as a subunit of the Lazarus Group, was behind the theft. The FBI also attributed the roughly $1.5 billion Bybit theft in February 2025 to North Korea.

How much was stolen from Binance?

Binance estimates about $6.3 billion. TRM Labs puts it at about $6.36 billion at theft-time prices and about $6.23 billion at prices a day later, and Chainalysis says about $6.4 billion. The totals differ mainly because token prices moved.

What did the FBI ask crypto companies to do?

It asked THORNode operators, RPC node operators, instant exchanges, DeFi services, analytics firms and other virtual asset service providers to block transactions involving the listed addresses and funds derived from them. It listed more than 600 Ethereum addresses, just under 20 bitcoin addresses and one Solana address. Reports describe it as a request, not a legal order.

How much of the stolen money has been frozen?

Tether’s chief executive said it froze more than $1.567 billion in USDT and Circle’s said more than $800 million in USDC, about $2.4 billion together. TRM counts about $2.7 billion frozen across all issuers and protocols. Frozen funds are not the same as recovered funds.

Is DeFi legally required to block the addresses?

Not as far as reporting shows. No coverage we found cites a court order, subpoena or OFAC sanctions designation for this theft. Tornado Cash’s sanctions were lifted in March 2025, and the legal status of sanctioning immutable smart contracts remains contested.