FBI names 628 crypto addresses in $6.4bn Binance heist but leaves banks off the hook
The FBI has published 628 crypto addresses linked to the $6.43 billion theft from Binance and asked private companies to block transactions with them. Banks are not on that list. The alert, which blamed North Korea for the 29 October hack, specifically called on crypto services companies to intervene, and little of the money appears to have come near a bank.
A "negligible amount" has likely been cashed out, and about $3.21 billion still sits in addresses linked to the theft, according to blockchain analytics firm Elliptic. Stablecoin issuers Tether and Circle moved quickly last week to freeze $2.85 billion, or 44% of the total, after the FBI named TraderTraitor, the North Korean state-backed group, as the culprit. By comparison, about 3% of the funds stolen from Bybit in 2025 were frozen.
No company can freeze bitcoin or ether because no company issues them. Nothing stolen on the bitcoin, XRP Ledger, Solana or NEAR blockchains has been frozen, Elliptic said. For those funds, the next opportunity to freeze them is when the bitcoin and ether become spendable cash. The thieves need "a counterparty," such as a centralised exchange, to do that transaction, Elliptic said. "That is where the funds can be identified and stopped."
Banks sit further down the line. By the time the money reached one, a bank often would not know it was tied to criminal activity unless the crypto services firm sending it knew and said so. "The bank oftentimes needs information from the exchange to determine where the funds originated," said Jon Glass, a partner in the financial crimes advisory practice at SolomonEdwards. "A bank may receive a wire from a legitimate exchange without knowing the funds were connected to a theft."
Brian Laverdure, senior vice president of digital assets and innovation policy at the Independent Community Bankers of America, said crypto firms are "the entities closest to the activity and best positioned to stop it." Community banks "should not be expected to serve as the cleanup crew for regulatory gaps elsewhere in the financial system," he said. None of the FBI's 628 addresses appear on the Treasury's Office of Foreign Assets Control sanctions list, leaving banks little information on which they can act.
What it means for Pakistan: Pakistani users of Binance and other global exchanges face heightened risk from the $6.4bn heist, as stolen funds could pass through local peer-to-peer traders or wallets. The State Bank of Pakistan and the Securities and Exchange Commission of Pakistan have not issued guidance on the FBI's 628-address blacklist, and Pakistan's virtual asset regulations remain in development. Crypto firms operating in Pakistan should screen against the list, but banks may lack the tools to trace such flows.
