FBI Links North Korea to $6 Billion Binance Hack, Urges DeFi Blocks

The FBI has confirmed that North Korea was behind the $6 billion hack of Binance. The agency is asking the decentralized finance (DeFi) community to block cryptocurrency addresses tied to the attackers, covering funds on the Bitcoin, Ethereum and Solana networks.

In its notice, the FBI listed hundreds of addresses. Blockchain analytics firm Chainalysis, however, said the Binance attackers have already used thousands of addresses, and it expects that number to keep growing.

Why the gap matters

Blocking addresses is one of the few tools DeFi platforms and other crypto services have to make stolen money harder to move. If a protocol or service refuses to handle flagged wallets, the attackers have fewer routes to swap, bridge or cash out their funds.

But a list only works as far as it is complete. With the attackers apparently spreading funds across far more addresses than the FBI named, any block list based on the notice alone will cover only part of the activity. That puts pressure on platforms to pair the official list with their own monitoring and with data from analytics providers.

What comes next

Because Chainalysis expects the number of attacker-controlled addresses to rise, the list is likely to need further updates as more wallets are identified. The public attribution to North Korea also places the Binance incident alongside other large crypto thefts that US authorities have linked to the country, and it signals that law enforcement wants the industry to act on the intelligence quickly rather than wait for the investigation to conclude.

For exchanges, DeFi protocols and wallet providers, the practical step is to screen against the FBI's addresses now and to be ready to add new ones as they surface.