The FBI said the Binance hack was carried out by the North Korean group TraderTraitor, a unit of the Lazarus Group. The agency published hundreds of cryptocurrency addresses linked to the attack and urged industry participants to block transactions passing through them.
During the October 29 attack, the perpetrators withdrew digital assets worth more than $6 billion from the platform. The FBI is tracking the movement of the funds together with the Secret Service and the Internal Revenue Service’s Criminal Investigation division.
Law enforcement determined that the hackers transferred the stolen assets primarily into Ethereum. They believe the cybercriminals will then try to conceal the assets’ origins using DeFi applications.
To prevent this, the FBI published more than 600 Ethereum addresses, 19 Bitcoin wallets, and one Solana address that held or still hold the stolen cryptocurrency.
THORChain node operators, RPC infrastructure providers, decentralized protocols, instant exchange services, and analytics companies were asked to block transactions involving these addresses and any assets received from them.
These are anti-money-laundering measures, not a technical ability to forcibly freeze any cryptocurrency at the blockchain level.Analysts found a connection to the Bitget hack
Chainalysis linked the Binance attack to TraderTraitor on October 30. Specialists noticed that the stolen funds were mixed on the blockchain with assets from the September Bitget hack, which had previously been attributed to North Korean hackers.
Chainalysis diagram: Funds from the address of the attacker who hacked Binance branch out to several intermediate addresses on the Tron network, then are gathered at a single address and sent to Ethereum through a service. There, they are mixed with funds from a previous hack attributed to North Korea, whose path is shown at the bottom of the diagram.
Diagram of the movement of funds stolen from Binance. 
According to the company, unauthorized transfers from Binance hot wallets across several blockchains totaled around $6.4 billion. The scheme depended on the network.
On Ethereum, the attackers used valid signed approvals that allowed them to run their own code through the exchange’s wallet. On other networks, some of the transfers looked like ordinary signed transactions.
Shortly after the attack began, the hackers tried to exchange $500 million in stablecoins for assets that the issuer cannot freeze. In 20 minutes, they managed to convert $325 million into ETH worth around $285 million. According to Chainalysis, the first freezes began at 17:14 US Eastern Time on October 29.
The subsequent movement of funds pointed to automated money laundering. The attackers carried out thousands of transactions between numerous addresses and repeatedly returned assets to wallets they had already used.
On Tron, a characteristic sequence could be traced: a new address first received exactly 1 TRX, then additional funds, which were subsequently moved on.
Chainalysis CEO Jonathan Levin suggested that the number of addresses involved in laundering could grow to tens of thousands in the coming weeks.
Binance has replenished 95% of its reserve shortfall
Meanwhile, Binance said that by November 1 it had replenished around 95% of the shortfall caused by the hack. The day before, the figure stood at 90%.
According to the exchange, customer funds in $BTC , $ETH , USDT, BNB, $SOL , USDC, XRP, USD1, RLUSD, and ZEC are now fully backed by reserves. The remaining 5% consists of less liquid tokens—the company continued buying them on the open market and through over-the-counter trades.
Binance used part of its SAFU and futures market insurance funds, as well as corporate reserves, for this. The company intends to restore the fund to around $1 billion later.
The exchange also took a new snapshot of reserves as of October 31. By November 3, it plans to publish full cryptographic proof that customer assets are backed.
Replenishing the reserves does not mean the stolen cryptocurrency has been recovered. Binance previously said that, with the help of industry partners, it had frozen around $3 billion.
The platform plans to resume withdrawals in stages, from 06:00 to 09:00 UTC on November 1. In the first stage, withdrawals will be available for major cryptocurrencies on 15 networks, including Bitcoin, Ethereum, Solana, Tron, and BNB Chain. Deposits are operating as usual.
Recall that the Binance hack raised questions about double standards in freezing stolen cryptocurrency.