- The FBI has attributed the $6bn Binance hack to North Korea and asked the industry to block hundreds of wallet addresses holding bitcoin, ether and SOL.
- Chainalysis says the attackers have already moved money through thousands of addresses, and expects that number to grow.
- Nobody can freeze bitcoin, ether or SOL. A blocklist is a request that companies refuse to serve the coins, not a switch anyone can flip.
The FBI has put a name to the largest theft in crypto’s history and published a list of wallets it wants the industry to shut out. The list runs to a few hundred addresses. The people it is aimed at are thought to have used thousands.
Stolen coins do not sit still. They get split, swapped, sold and bought again, and some of them end up in accounts belonging to people who had nothing to do with the theft. When an exchange decides a deposit traces back to a flagged wallet, the standard response is to freeze the account while it checks. That is the part of this story that can reach an ordinary UK holder, and it is the part nobody has yet explained clearly.
What the bureau said
According to CoinDesk and The Defiant, the FBI’s notice attributes the hack to a North Korean state operation that US agencies track under the name TraderTraitor, and asks exchanges, and other service providers to block the listed addresses. We have not seen the notice itself, and nothing below rests on anything beyond what those outlets reported.
The loss figure, above $6bn, is the same one Binance has been working with since the hack. We covered the reserve the exchange set aside against it in our earlier reporting, and the mechanics of how the attackers gained signing authority remain the open technical question.
Blocking an address does not freeze anything
This is where the language in the headlines does more work than it should. A address is not an account at a bank. There is no administrator, no customer services desk and no legal mechanism that reaches into a bitcoin wallet and stops the coins moving.
There is one category of asset where freezing is genuinely possible. like USDT and USDC are issued by companies, and those companies keep the ability to blacklist an address inside the ’s own code. Push stolen funds into Tether and Tether can switch them off.
Bitcoin, ether and SOL have no issuer. So when law enforcement asks the industry to block an address holding those coins, what is actually being requested is that everyone who runs a service refuses to deal with it: that exchanges reject the deposit, that bridge and swap front-ends refuse to load the transaction, that relayers decline to pass it on. Compliance is a choice for each company, backed by sanctions law for the regulated ones and by nothing much for the rest.
Hundreds against thousands
Generating a new address costs nothing and takes a fraction of a second. That is the arithmetic problem with any published list. Chainalysis told CoinDesk the Binance attackers have already used “thousands” of addresses and that it expects the count to keep rising, which means a static notice of a few hundred is describing a position the money has already left.
Our inference, and we flag it as ours rather than anyone’s finding: the list is less an interception tool than a paper trail. Once an address is published by the FBI, no firm that touches it can later claim it did not know. That matters for enforcement actions years from now. It does very little to recover the coins this week.
The practical blocking, if it happens at all, will come from the compliance vendors who track these flows continuously and feed updated labels straight into exchange systems. Those lists are commercial and they are not published.
Where this reaches a UK holder
Buying on a regulated exchange, you are not going to be handed sanctioned coins across the counter. The risk sits with deposits from elsewhere: a peer-to-peer trade, a payment for work, coins passed along a chain of transactions that began somewhere you have no visibility of.
If screening software flags that history, the usual outcome is a frozen account and a request for proof of where the funds came from. Resolving it is possible and it is also slow, which is an argument for not keeping everything in one place. Our guide to withdrawals covers what to do when an account is restricted, and the self-custody guide sets out the trade-offs on the other side.
Binance’s own position
Separately, the exchange says it has moved 7,499 BTC out of its SAFU emergency fund, that roughly 90% of the lost amount has been replenished, and that it intends to rebuild the fund to around $1bn. It has kept 1 November as its target for restarting withdrawals. Those are the company’s statements about its own balance sheet.
What to watch
Whether withdrawals actually restart on the stated date, and whether they restart for everyone or in stages. A slipped date would say more about the state of the exchange’s books than any figure it publishes voluntarily.
And whether any exchange reports freezing customer accounts as a result of this list. That would be the first sign the blocking request has moved from a notice to something ordinary users feel.