Brian Reed: Hey. You look like you've had a morning.
Eliza Ward: The FBI just formally attributed a six-point-three billion dollar theft from Binance to a North Korean group called TraderTraitor. So. Yeah.
Brian Reed: Hold on — formally attributed? As in they put a name on it publicly?
Eliza Ward: Public statement. TraderTraitor named. October 29th flagged as the date. And they specified Ethereum — that's where the stolen assets were primarily converted, per the FBI.
Brian Reed: Six point three billion from — Binance is the biggest exchange in the world by volume. That's not a small target someone stumbled into.
Eliza Ward: No. And TRM Labs — the blockchain analytics firm — they assessed it at approximately six point three six billion, which is where that figure is coming from. They also attributed it to TraderTraitor with, quote, high confidence.
Brian Reed: So TRM and the FBI are aligned on attribution. That's — okay, the part I want to understand is what that alignment actually means. Did they reach the same conclusion independently?
Eliza Ward: That's the right question and I don't have a clean answer yet.
Brian Reed: Set that aside for a second, because I want to make sure the scale actually lands. Think of it like this — if every bank robbery in the United States last year combined to net two point eight billion dollars, this one job just beat the whole stack. Twice over.
Eliza Ward: Wait — two point eight billion is actually the real number. The State Department cited at least two point eight billion in North Korean crypto theft across forty-plus heists, January 2024 through September 2025. The Binance theft alone more than doubles that.
Brian Reed: More than doubles the cumulative total. From one job.
Eliza Ward: And to put a finer point on it — DMM Bitcoin, a Japanese exchange, lost three hundred and eight million in 2024. That was already a major headline, right? Attributed to North Korean hackers, same social-engineering playbook. This is twenty times that number.
Brian Reed: Twenty times — okay, so we're not talking about an incremental jump.
Eliza Ward: No. And TRM Labs tracked the funds moving across roughly ten blockchains — Bitcoin, Ethereum, stablecoins including Tether and USD Coin. So this isn't one clean ledger entry, it's — I mean, it's deliberately fragmented.
Brian Reed: Which is also worth naming clearly — TraderTraitor isn't some freelance crew. TRM Labs describes it as the cryptocurrency-specialist arm of Lazarus Group, which is North Korea's broader state hacking apparatus. So when the FBI attributes this, they're attributing it to a state program, not a criminal gang.
Eliza Ward: That's the part that actually changes the frame, yeah. Lazarus Group is the umbrella. TraderTraitor is — actually no, the better way to put it is: TraderTraitor is the division that specifically exists to do this.
Brian Reed: And they just had their biggest quarter ever, by a factor of twenty. The question is what that capacity signals going forward — but that's genuinely unknown right now.
Eliza Ward: But that capacity claim only holds if the attribution is solid — and I'm not sure it is. The take already circulating is that the FBI confirmed it, case closed. That's not what happened.
Brian Reed: What do you mean? The FBI put out a statement.
Eliza Ward: They did. But the Lazarus Group connection — TraderTraitor being a Lazarus component — that came from TRM Labs, not the FBI's own forensic chain. The FBI named TraderTraitor. TRM Labs is the one who drew the line to Lazarus Group specifically.
Brian Reed: And TRM Labs has Binance Custody as a client. So the firm doing the attribution analysis has a business relationship with the victim.
Eliza Ward: Right — that's the conflict flagged by analysts including @Bithunt_io on social media. I'm not saying TRM fabricated anything. The on-chain data is the on-chain data. But attributing movement to a specific nation-state actor requires inference on top of the chain data, and every entity making that inference here has a stake in it being believed. The FBI, TRM Labs, Binance. None of them are disinterested.
Brian Reed: Does the on-chain evidence not speak for itself, though? Like, if funds move in a pattern consistent with TraderTraitor's known signatures—
Eliza Ward: Pattern-matching to a known group is still inference. The FBI, the Secret Service, IRS Criminal Investigation — they ran this together and haven't released the underlying forensic evidence publicly. And there's a tell: Binance cited six-point-three billion, TRM Labs assessed six-point-three-six billion. That gap is small but it means independent verification hasn't actually closed.
Brian Reed: Then there's ZachXBT's claim — the DevOps engineer, the romantic connection to a North Korean operative, the unattended laptop. Where does that land?
Eliza Ward: Unconfirmed rumor. Neither the FBI nor Binance has validated it. ZachXBT is a credible on-chain investigator but that's still a social media post, not evidence. And we should say that plainly. The laundering side — what actually happened to the money after it moved — that's messier, and we'll get to that.
Brian Reed: And that laundering piece is structurally strange. The FBI put out a public appeal. THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms — they asked all of them to voluntarily block TraderTraitor-linked transactions.
Brian Reed: No enforcement mechanism. That's not me editorializing — there literally isn't one. Imagine a port security officer watching every container on a live scanner screen, seeing exactly which crate holds the contraband, and having zero authority over the crane operators. That's the FBI's actual position here.
Eliza Ward: And Ari Redbord at TRM Labs basically priced in the failure of that appeal already. He said he expects TraderTraitor to break the haul into smaller pieces and run it through smaller exchanges — and that this takes months.
Brian Reed: Months. So the FBI is appealing to voluntary actors while the laundering is — I mean, it's already happening on a timeline the FBI can see and mostly can't interrupt. That's not a gap in the response, that's the whole shape of it.
Eliza Ward: Which is why Richard Teng's replenishment claim almost doesn't matter to the actual problem. He said Binance covered 90% already, committed to the remaining 10%. But that's — wait, that hasn't been independently verified at all. And even if it's true, it addresses Binance's liability, not the DPRK's revenue.
Brian Reed: The part I don't get: 90% of six-point-three billion is — what, roughly five-point-seven billion? You can't print Bitcoin. So where does that come from? Reserves? Asset sales over six months while markets move?
Eliza Ward: We don't know. Teng didn't say. And that gap actually matters because if it's a slow liquidation, the remaining 10% hole could widen depending on price movement. The claim is real — the mechanism behind it isn't confirmed.
Brian Reed: So what actually changes? TraderTraitor runs this playbook regardless — DPRK's sanctions-evasion engine doesn't stop because Binance patched a balance sheet. The watch item isn't Teng's replenishment schedule. It's whether any international response goes after the infrastructure inside North Korea. And right now there's no signal that it does.
Eliza Ward: And that's actually what I keep thinking about. Blockchain made this the most visible financial crime in history. Every transaction, every address, public and traceable in real time. And it may still be completely unrecoverable. Those two things are both true simultaneously.
Brian Reed: And the exchange that lost it says it's already mostly fixed. With no independent verification of what 'fixed' even means at five-point-seven billion dollars.
Eliza Ward: Right — and here's where I genuinely don't have an answer. The Binance theft alone more than doubles every DPRK crypto theft across forty-plus heists from January 2024 through September 2025. That's the State Department's own number — two point eight billion over a year and a half, from dozens of operations. One job beats all of it, twice. So if a single state actor can move that kind of money, and the only entities positioned to confirm the attribution are TRM Labs — which has a client relationship with Binance — and the FBI, which hasn't released its underlying forensics... I don't know what accountability actually looks like. I'm not sure anyone does.
Brian Reed: The part that stays with me is that Richard Teng's 90% replenishment claim — even if it's completely true — doesn't answer that question at all. It just means Binance's users are made whole. TraderTraitor still has the money.
Eliza Ward: Yeah. What would actually settle this — for me — is the FBI releasing the forensic basis for the TraderTraitor attribution. Not the conclusion. The chain. Until that's public, we have a confirmed event and an unverified explanation, and every entity vouching for the explanation has a reason to want the story to end quickly.
