FBI links record Binance cryptocurrency theft to North Korean hackers

The FBI has blamed North Korean hackers for the theft of $6.3 billion in cryptocurrency from Binance, describing the attack as the largest cryptocurrency heist in history. The bureau said the incident was linked to an entity known as TraderTraitor, which it also identified as responsible for last year’s $1.5 billion hack of Bybit. The theft occurred on Thursday and involved bitcoin and other digital currencies taken from the world’s largest cryptocurrency exchange.

The FBI said its investigation connected the attack to “malicious cyber activity” associated with TraderTraitor, although the supplied reports do not detail how the bureau reached that conclusion. The agency has asked cryptocurrency exchanges, blockchain analytics companies and other organisations to block transactions associated with a list of addresses. Its stated aim is to prevent the stolen assets from being laundered and to help trace their movement through the digital-asset system.

According to the FBI, the hackers were primarily converting the stolen holdings into ethereum. The bureau expects TraderTraitor to try to move the assets through decentralised-finance platforms and “instant swap services,” which can allow cryptocurrencies to be exchanged rapidly across networks. Ari Redbord, chief policy officer at blockchain-intelligence firm TRM Labs, said the hackers could divide the funds into smaller amounts and route them through smaller exchanges to make detection more difficult.

He said the process could continue for months, but that blockchain tracking also made it possible to follow the funds in real time and potentially disrupt or seize them. “It’s bank robbery, in this case, at the speed of the internet,” Redbord said. He described the effort to track the funds and the hackers’ attempts to move them as a “cat and mouse game.” His comments were reported in the South China Morning Post.

Binance has sought to reassure customers about the financial impact. The exchange said on Saturday that it had enough of the same digital currency set aside to cover 90% of the missing assets, according to the South China Morning Post. Sky News likewise reported that around 90% of the stolen cryptocurrency had been replenished.

The reports do not explain whether the replenishment represents funds recovered from the attackers, assets held by Binance before the incident, or another form of reserve. Binance did, however, promise that customers would be fully reimbursed. The case places the exchange, investigators and the cryptocurrency industry under pressure to identify and stop the stolen funds before they can be converted or dispersed.

The FBI’s request for cooperation indicates that the response will depend on exchanges and blockchain-monitoring companies recognising and blocking the addresses associated with the theft.