fbi

According to The Wall Street Journal, the Binance hackers immediately launched a large-scale money laundering operation after their heist. According to Chainalysis data, the organization dispersed the funds to over 10,000 cryptocurrency wallets.Some cryptocurrency service providers continued to process transactions related to the theft and charge fees even after the FBI called for a halt. THORChain processed over $46 million in stolen funds within 72 hours of the theft and charged over $200,000 in fees; nearly $4 million was mixed through Wasabi Wallet.Some developers stated that they could not prevent North Korean hackers from laundering money through their platform, which has frustrated law enforcement agencies.

According to reports from multiple media outlets including Decrypt, the U.S. Attorney's Office for the Eastern District of Virginia stated that former FBI agent Patrick Steven Yaroch pleaded guilty on November 5 in federal court in Alexandria to charges of telecommunications fraud and money laundering.He used stolen credentials to conduct approximately 100 fraudulent transfers from 35 cryptocurrency wallets involved in FBI investigations, stealing about $2.47 million in cryptocurrency assets, and concealed the source of the funds through methods such as exchanging tokens. Some of the funds were used to pay off debts such as credit cards and auto loans. Yaroch faces a maximum of 20 years in prison, with sentencing scheduled for March 4, 2027. Previous reports indicated that the amount involved was approximately $1 million.

According to The Washington Post, former FBI agent Patrick Yaroch is scheduled to appear in front of Judge Patricia Tolliver Giles at the U.S. District Court for the Eastern District of Virginia to plead guilty for allegedly stealing approximately $1 million in digital assets from cryptocurrency wallets associated with hostile nations. Prosecutors stated that he had used ChatGPT to plan his move to Portugal.

On November 4, the head of the Binance Chinese community, Sisi, responded to the security incident at the end of October, stating that approximately $6.3 billion was transferred out of the Binance system, and the responsibility lies with Binance, not with any individual engineer or technical standard. She stated that the related losses would be compensated by the platform, and users could verify themselves on the reserve proof page; the frozen and intercepted portions would be recovered one by one in cooperation with law enforcement and on-chain institutions.Sisi mentioned that after the withdrawal was reopened, the platform focused on ensuring that every withdrawal was processed. She stated that the scale of withdrawals in the past two days was on the same level as the stolen amount, and every transaction had been fulfilled, with user assets remaining intact; the platform did not misappropriate user assets. She also stated that the company's decision-making body requested that the investigation report be unembellished and truthfully disclosed, with timelines, attack paths, malicious script operations, and internal shortcomings all included in the report.Sisi cited an FBI report stating that the adversary was a nation-state actor, and since the beginning of this year, Binance had intercepted 57 suspected attacks from the same source. She indicated that all intrusion points mentioned in the report had been blocked; as of November 3, the affected wallet system had been rebuilt in a new environment, internal AI tools had been rebuilt and permissions tightened, affected devices had been replaced, relevant credentials and tokens had been invalidated, and a comprehensive device security scan and wallet risk control upgrade had been completed. She also mentioned that some defensive lines would not be made public and that an independent third-party security agency had been hired for review, with the conclusions to be announced externally. Binance's preliminary investigation previously indicated that the incident involved assets of approximately $6.34 billion, with about $2.85 billion frozen or intercepted, and the losses would be borne by the platform.

According to the Korean Central News Agency, North Korea mentioned in its denial of involvement in the theft related to Binance that last year the United States linked the hacking incident at the cryptocurrency exchange platform Bybit to North Korea. The Korean Central News Agency stated that the United States misled international public opinion, creating the illusion that cyber fraud occurring around the world was all orchestrated by North Korea, which is a serious political provocation against North Korea. North Korea firmly opposes any attempts to politicize cyber issues and use them as a means of interfering in the internal affairs of other countries, stating that this is the consistent policy position of the Democratic People's Republic of Korea government.The Korean Central News Agency also stated that it is necessary for the international community to reflect again on the fact that the current U.S. government announced the confiscation of illegally stolen cryptocurrency assets, acting as a national strategic reserve as soon as it took office last year. The Korean Central News Agency suggested that if the stolen massive cryptocurrency funds were to be recovered, one might discover clues related to the hacking incident. On February 21, 2025, Bybit experienced a large-scale theft incident, with a total value of approximately $1.5 billion. The U.S. FBI and several on-chain analysis agencies subsequently attributed the incident to the North Korean Lazarus Group (TraderTraitor).

On November 2, stablecoin issuer Tether announced that it froze over 1.5 billion USDT within 30 minutes after Binance was attacked on October 29, preventing the related funds from being transferred, exchanged, or laundered. Tether stated that the FBI has identified North Korea as responsible for this attack. The FBI reported on October 31 that North Korea stole over 6 billion dollars in virtual assets from Binance around October 29, referring to the activity as TraderTraitor.Tether CEO Paolo Ardoino stated that the team froze over 1.5 billion dollars within minutes of the attack and claimed that USDT is not suitable for hiding stolen funds. Tether USA₮ CEO Bo Hines stated that the company acted immediately to prevent over 1.5 billion dollars from flowing to the attackers and said that this move contributes to safety in the U.S. and globally. Tether claimed that it collaborates with U.S. and international law enforcement agencies and industry partners to track illegal funds and assist in accountability.Tether also disclosed that as of October 31, it has assisted the U.S. Department of Justice, Secret Service, and FBI in freezing over 3,590 wallets, approximately 1.6 billion dollars in USDT, and has collaborated with over 360 law enforcement agencies in 73 countries. Including the freezes related to this Binance incident, Tether has cumulatively frozen over 7 billion dollars in USDT across secondary market addresses, of which approximately 1.2 billion dollars has been returned to rightful owners or law enforcement agencies through reissuance.

On-chain analyst and Security Alliance contributor SomaXBT stated that North Korean hackers laundered approximately $242 million of stolen funds from Binance within two days. Meanwhile, the FBI is pressuring platforms like THORChain to halt related transactions.SomaXBT noted that the stolen funds were transferred through multiple cryptocurrency cross-chain bridges, with Relay handling $48 million in outflows, THORChain managing $44 million, Chainflip processing $32.1 million, and Symbiosis dealing with $16 million, totaling approximately $140 million. The final destination of these funds remains unclear.

Binance co-founder He Yi stated that Binance needs to collaborate with U.S. companies to freeze and recover assets, and that U.S. law enforcement agencies (FBI) are very efficient in their involvement.In cases that attract global attention, any content released by law enforcement agencies is rigorously verified and substantiated. Binance just wants to get back its hard-earned money.

According to a report from the Federal Bureau of Investigation (FBI), North Korea is responsible for the theft of over $6 billion in virtual assets that occurred around October 29 involving Binance. The FBI has referred to the related cyber activities as TraderTraitor.The FBI stated that it, along with the United States Secret Service and the Internal Revenue Service Criminal Investigation Division, has observed that the individuals involved primarily exchanged the stolen assets for ETH, and it is expected that further money laundering will occur through DeFi and instant exchange services.The three agencies have called on node operators, instant exchange platforms, DeFi services, and other virtual asset service providers to intercept and report transactions related to or originating from the addresses listed in the report.

The Federal Bureau of Investigation (FBI) responded to the Binance theft incident, stating that it is aware of the incident and is communicating with relevant partners to understand the scope of the activities and assess the potential impact.

According to a report by Reuters citing informed sources, Binance is cooperating with law enforcement agencies around the world, including the Federal Bureau of Investigation (FBI) and the United States Secret Service (USSS), to investigate the theft of approximately $6.3 billion in cryptocurrency.The U.S. Embassy in London stated that it would not comment on the matter, and the United States Secret Service has not yet responded to requests for comment.

U.S. President Trump will emphasize his administration's actions against overseas cryptocurrency fraud at a cybercrime prevention event at the White House on Wednesday. According to Reuters citing White House officials, these overseas criminal networks lure Americans into participating in fraudulent cryptocurrency investments. Trump and cabinet members plan to point out that the government has shut down multiple fraudulent cryptocurrency investment websites and is working to close down online impersonation scams. Secretary of Homeland Security Markwayne Mullin, FBI Director Kash Patel, Secretary of Defense Pete Hegseth, and Attorney General Todd Blanche are expected to attend.The event follows an executive order from March this year, where Trump instructed the Department of Justice to prioritize identifying and prosecuting cyber fraudsters, followed by a memorandum requiring the Department of Homeland Security to collaborate with private companies to monitor foreign criminal hacker organizations. FBI data shows that in 2025, over 1 million cyber fraud complaints were submitted by the American public, a 17% increase from 2024, with record losses. Cryptocurrency fraud accounted for more than half of the losses, with the FBI's Internet Crime Complaint Center recording 181,565 cryptocurrency-related complaints, resulting in losses of $11.366 billion, with cryptocurrency investment fraud causing $7.2 billion in losses.Most of the fraud activities trace back to organized crime groups in Southeast Asia, involving Cambodia, Laos, and Myanmar, where criminals exploit trafficking victims as forced labor in scam operations. Americans aged 60 and above bear the heaviest losses, with cryptocurrency-related losses reaching $4.43 billion. Cryptocurrency ATM fraud caused losses of $389 million, a 58% increase from 2024; secondary scams targeting previous victims caused an additional $1.4 billion in losses. The FBI's "Operation Upgrade" notified 3,780 victims suffering from cryptocurrency investment fraud in 2025, estimated to recover $225.8 million.

According to CryptoBriefing, the Virtual Currency Unit (VCU) led by Brooklyn Assistant District Attorney Alona Katz collaborated with the FBI's New York office to conduct a joint operation that seized or shut down 241 fraudulent domain names and 112 servers. This operation marks the conclusion of a three-year investigation into an internationally connected cryptocurrency investment fraud network.The network primarily targeted Russian-speaking communities, directing victims to fake cryptocurrency investment platforms through Russian advertisements on Facebook, and then carried out secondary fraud under the guise of "recovering funds." Investigators estimate the related losses to be in the tens of millions of dollars, with some victims losing their entire savings. The prosecution has currently recovered about $300,000 for the victims, and there have been no reports of arrests from this operation. The FBI's Internet Crime Complaint Center's 2025 Internet Crime Report indicates that cryptocurrency-related fraud losses reached $11.366 billion that year, a 22% increase from the previous year. Losses from cryptocurrency fraud accounted for more than half of all internet crime losses in 2025.

According to Decrypt, the Virtual Currency Unit of the Brooklyn District Attorney's Office in New York, in collaboration with the FBI, successfully dismantled a multinational cryptocurrency investment scam network targeting the Russian-speaking community across the United States, seizing and shutting down 112 servers and 241 associated website domains. The involved servers were primarily hosted in Eastern Europe and the United States, with the core infrastructure and IP nodes distributed in places like Ukraine.Forensic evidence from the servers also indicated that the scammers would strike again weeks later, disguising themselves as "asset recovery service providers" to conduct secondary harvesting of victims, with the total amount involved reaching tens of millions of dollars. The prosecution had previously shut down 400 associated domain names, and this time directly seized the underlying servers to completely deprive the gang of the ability to quickly set up websites and contact victims. Law enforcement has currently seized approximately $300,000 in stolen funds, and the recovery efforts are ongoing.

According to Decrypt, the Federal Bureau of Investigation (FBI) arrested OpenAI engineer Abdulrahman Alfozan on October 9. The suspect, 35 years old and of Saudi nationality, has been employed at OpenAI since July 2025 and is accused of using or attempting to use devices to intercept oral communications. He made his first appearance in federal court this Tuesday. OpenAI stated that it has referred the matter to the FBI and thanked the relevant agents and prosecutors for their swift action, while the FBI's investigation is ongoing.OpenAI released a statement on X, stating that the company discovered a sophisticated recording device hidden in the office and used its own model to analyze the device and its origin, ultimately identifying that an employee placed it there a few days prior. According to the criminal complaint, the device was discovered around September 30, plugged into a USB port on the back of a television, wrapped in paper towels, with its contents encrypted, and was installed around September 28. Surveillance footage showed that Alfozan was seen near the conference room multiple times before the device was discovered, but he had neither the authority to enter that room nor to attend the related meetings, which typically involved confidential technical and strategic information.The complaint states that before the device was installed, Alfozan used internal productivity tools to inquire about OpenAI's office building address, conference rooms, room capacities, schedules, and locations of meetings between executives and external partners. A chatbot account associated with his spouse asked between September 24 and 30 how to create a continuous recording device, add Wi-Fi connectivity, enhance real-time listening capabilities, and encrypt the device's SD card.

The Federal Bureau of Investigation (FBI) reported that the losses associated with the scam center have reached 1.7 billion dollars. During the same period, law enforcement actions conducted in West Africa resulted in the arrest of 28 individuals.The Department of Justice (DOJ) stated that during a week-long coordinated law enforcement operation, law enforcement agencies removed over 3.7 million online accounts, pages, and groups, and identified over 11 million dollars in funds that could potentially be frozen.

On October 13, the U.S. Department of Justice announced the arrest of two Americans in an operation targeting North Korean IT personnel who entered U.S. companies under false identities, and the seizure of approximately 187 computer devices. Michael James Bostelle from Pennsylvania and Juan Cecilio Pena Carrillo from Texas were arrested based on an indictment from the Northern District of Ohio Federal Court. Prosecutors allege that the scheme involved over 70 U.S. employers, generating approximately $3 million in revenue for overseas IT personnel. The two are charged with conspiracy to commit wire and mail fraud, conspiracy to commit money laundering, and conspiracy to commit identity theft, with Pena additionally charged with aggravated identity theft.The device seizure operation is part of "Operation Lone Star," coordinated by federal law enforcement in the Northern District of Texas. From September 21 to 25, the FBI executed searches at over 40 suspected "laptop farm" residences in Texas, seizing devices including laptops and keyboards, video, and mouse equipment for remote access. According to the Ohio indictment, domestic accomplices received laptops issued by employers at home and then allowed overseas personnel to control them via remote access software or hardware, making it appear as if they were located in the U.S. and accessing company systems, while the accomplices received salaries and transferred funds overseas.The indictment mentions cryptocurrency as one of the means for transferring funds overseas. Trey Michael Nolte, a resident of Ohio, is listed as a co-conspirator but has not been charged in this case; the indictment states that in a conversation on July 8, 2024, he described managing transfers between bank accounts and virtual currencies using spreadsheets, subsequently transferring funds to the defendant Sun Sheng Ming;

The Federal Bureau of Investigation (FBI) tracked and seized over $560,000 in cryptocurrency originally intended for Hamas by combining blockchain analysis, human intelligence, and court orders. The investigation involved shared wallets, cross-chain bridges, exchanges, and stablecoin accounts. Three seizure operations occurred in March, June, and October 2025.Investigators found that multiple donation addresses associated with Hamas's military wing, Al Qassam Brigades, used the same Gas wallet to pay transaction fees, and visualized funds flowing from donation wallets to operational wallets and related infrastructure through Reactor. In the June 2025 case, funds circulated through new addresses, accounts, over-the-counter brokers, and suspected money mule accounts; in October, the network switched to one-time donation wallets and cross-chain bridges. Court orders required Tether to destroy USDT from specified addresses and to reissue equivalent assets to law enforcement wallets, while Binance was instructed to transfer the balances of three accounts.