FBI Ties 628 Crypto Addresses to North Korean TraderTraitor, $6.3B in Stolen Funds

Key points

• FBI attributes 628 wallet addresses to TraderTraitor, a North Korean operation.
• The linked activity involves $6.3 billion in stolen funds.
• Binance is asked to block transfers tied to the addresses.
• Agencies should treat the addresses as high-risk and monitor for exposure.

The FBI has linked 628 digital-wallet addresses to TraderTraitor, a North Korean state-sponsored intrusion cluster, and says the addresses are connected to $6.3 billion in stolen funds. The bureau is asking Binance to stop transfers involving those wallets, turning the case into a broad blocking effort rather than a single seizure.

Although the activity centers on cryptocurrency wallets, the fallout reaches any organization that accepts, custodies, or monitors digital assets. Schools, agencies, and vendors that handle payments or donations should assume the listed addresses are high-risk and check whether their systems or staff have interacted with them.

The dollar figure and address count show why this is more than a routine fraud alert: the linked wallets create a large, reusable watchlist for compliance and security teams. Blocking transfers can disrupt laundering, but it also requires accurate address matching and quick escalation when a transaction is attempted.

Watch for new guidance from investigators, changes to the address list, and attempts to move value through exchanges or intermediaries. IT and finance teams should treat the addresses as indicators, preserve logs, and route suspicious activity to legal and incident-response leads. The FBI's request to Binance is a signal that private platforms are being enlisted to enforce controls.

What to do now

1. Ingest the 628 addresses into email, web, DNS, and endpoint blocklists; deny wallet or exchange access from managed devices unless explicitly approved.
2. Send the address list to finance and procurement; require dual approval for any crypto payment or donation refund.
3. Search logs and browser histories for visits to exchanges or wallet tools; flag any transaction to listed addresses.
4. Enable MFA and conditional access for accounts tied to crypto custody, exchange, or payment platforms; remove stale access.
5. Configure alerts for DNS and network traffic to known exchange and wallet services; escalate attempted transfers.
6. Preserve relevant logs and contact law enforcement or incident response if an address match appears.
7. Brief staff on phishing and fake donation or payment requests; require verification of wallet changes.

Original source

Hackread