FBI links $6 billion Binance theft to North Korea

The FBI says North Korea was behind the theft of more than $6 billion in virtual assets from Binance, identifying the activity as the work of a group it calls TraderTraitor. Binance, the world’s largest cryptocurrency exchange, was hit on October 29 in what the Associated Press describes as the largest crypto heist on record.

The bureau’s October 31 announcement says investigators have observed the stolen assets being converted primarily into Ether. The attribution puts a named state-linked hacking group at the center of a theft whose immediate next phase is the movement and possible laundering of funds across crypto services.

How did the attackers move the funds?

Blockchain analytics firm Chainalysis says the transfers began around 4:20 p.m. Eastern on October 29, moving funds from Binance hot wallets across multiple blockchains. Hot wallets are connected to the internet and used to handle transactions. On Ethereum, Chainalysis says an operational wallet submitted signed authorizations that let a Binance hot wallet run attacker-deployed code and sweep assets to attacker-controlled addresses.

Chainalysis estimates the transfers at about $6.4 billion. Its account describes a race to convert assets that could be frozen: the attacker moved $500 million in stablecoins to a wallet used for swaps, then exchanged $325 million of them for $285 million in Ether over nearly 20 minutes. Stablecoins such as USDT and USDC can be frozen by their issuers; bitcoin and Ether generally cannot be frozen in that way. Chainalysis says freezes began at 5:14 p.m. Eastern.

What can exchanges and users do now?

The FBI, the U.S. Secret Service and the IRS Criminal Investigation division are asking crypto businesses to block transactions linked to addresses associated with TraderTraitor. The request covers node operators, instant exchanges, decentralized finance services and other virtual-asset providers. For those firms, the practical task is to check transaction exposure against the addresses in the FBI alert and stop funds from moving through their services where possible.

The FBI expects the group to use decentralized finance and instant-swap services for further laundering. Chainalysis reported that about $2.8 billion had been frozen as of 11:30 a.m. Eastern on November 3. That is a substantial intervention, but it does not mean the funds have been returned to customers. The Associated Press reports that Binance said it had enough of the same digital assets set aside to cover 90% of the missing funds and promised customers full reimbursement.

What is the next point to watch?

The investigation is still focused on where the remaining assets move and whether exchanges, stablecoin issuers and other services can identify and freeze them. Chainalysis says its investigators are seeing thousands of transactions in a short period, with repeated routing patterns that suggest automation. The FBI has published a list of associated addresses and says the assets may be pushed through DeFi and instant swaps.

That makes the next measurable update the amount of stolen crypto frozen or recovered as tracing continues. The latest figure reported by Chainalysis was about $2.8 billion frozen by November 3; the FBI’s alert asks industry participants to help prevent the rest from being laundered. The Associated Press report also notes that the FBI ties TraderTraitor to last year’s $1.5 billion Bybit hack.

Sources

• October 31 announcement — fbi.gov
• The Associated Press report — apnews.com