FBI Attributes $6.43B Binance Theft to TraderTraitor via Wallet List and ETH Conversion Pattern

The agencies released wallet addresses tied to post-theft flows that shifted stolen assets into Ethereum before DeFi swaps. Elliptic data shows 82 percent of the haul originated on Ethereum and Bitcoin, nearly doubling prior North Korean totals. Technical indicators released remain limited to on-chain movements rather than malware samples matching FLATROOF or ROOFDECK implants previously linked to the group by SentinelOne and Microsoft.

TraderTraitor has conducted recruitment lures since 2020, recently trojanizing Terraform providers to deliver cross-platform backdoors. The Binance incident follows the same social-engineering vector seen in DMM Bitcoin and Bybit breaches, yet no public sample connects the heist infrastructure to those developer-workflow compromises. Official attribution rests on wallet clustering while independent blockchain tracing supplies the only verifiable evidence trail.

$2.85 billion frozen on-chain indicates rapid exchange and bridge cooperation, but remaining funds face instant-swap laundering across multiple chains. This pattern matches prior DPRK operations where frozen amounts later reappear through privacy mixers and new front entities. Next phase will likely involve layered DeFi routing before attempted off-ramps via OTC desks.