The FBI describes the next laundering stage
The FBI Cyber Branch says North Korea's TraderTraitor actors are converting assets stolen from Binance primarily into Ether (ETH). The bureau expects the attackers to move those assets through decentralized-finance and instant-swap services as they prepare them for further laundering stages.
The statement was issued with the US Secret Service and IRS Criminal Investigation after the FBI formally attributed the more-than-$6-billion theft to North Korea.
The agencies have published a list of addresses associated with the activity. That provides infrastructure operators with specific indicators to screen, rather than only a group name or a general warning.
The request reaches DeFi and network infrastructure
The FBI, USSS and IRS-CI are urging a broad set of private-sector entities to block transactions with, or derived from, the listed TraderTraitor addresses. The request names:
- THORNode operators;
- RPC node operators;
- instant exchanges;
- DeFi services;
- blockchain analytics firms;
- and other virtual-asset service providers.
This is broader than asking centralized exchanges to freeze deposits. It explicitly reaches decentralized protocols, swap infrastructure and access providers that may encounter assets downstream from the original theft.
The request is an operational warning from law enforcement. The FBI statement does not itself establish that every named service has the same legal duties, technical ability or governance process for blocking transactions.
Why the ETH conversion matters
Stablecoin issuers can blacklist specific assets, and several issuers acted during the first hours of the Binance incident. Native ETH does not have an issuer with an equivalent freeze function.
Converting stolen assets to ETH can therefore reduce exposure to issuer-level freezes, but it does not make the funds invisible. Transfers remain public, and services interacting with flagged addresses can screen, reject or report them depending on their architecture and obligations.
The laundering path also creates market and protocol risks. Large swaps can move prices, increase slippage and expose liquidity pools or service providers to assets linked to a state-sponsored operation. It does not follow that Ethereum or the named DeFi categories were compromised.
What remains unresolved
The agencies have not said how much of the stolen portfolio has already been converted to ETH, how much has entered DeFi services or what portion of the listed funds remains recoverable.
Binance separately says approximately $3 billion has been frozen and that it has replenished more than $5 billion in matching assets. Those recovery figures should not be confused with the FBI's description of the attackers' laundering activity.
The precise position is now: US law-enforcement agencies say TraderTraitor is converting stolen Binance assets mainly into ETH and may use DeFi and instant-swap services for further laundering. They have published associated addresses and asked infrastructure operators to block related transactions.
Follow Signal21's complete Binance incident timeline for the theft, freezes, attribution and recovery updates.
This is a developing story. Signal21 will update the coverage if the agencies add addresses, sanctions or enforcement actions.