FBI Attributes $6 Billion Binance Crypto Heist to North Korean Hackers

The money is already being converted, primarily into Ethereum
The FBI says it has observed North Korean actors moving the Binance loot into Ethereum.
Mark

Why does the FBI naming North Korea matter, beyond the headline?

Mimi

Because it's a formal attribution from the FBI, with the Secret Service and IRS-CI alongside it. It names a specific group, TraderTraitor, and says what it's seeing the money do.

Mark

And what is it seeing?

Mimi

The stolen assets are being converted mainly into Ethereum. The FBI expects them to go through DeFi and instant swap services next, as preparation for further laundering.

Luke

Careful there. The conversion into Ethereum is something the FBI says it has observed. The later laundering is an expectation, not a finding.

Mark

Fair. What about the customers?

Mimi

Binance says it has covered about 90% of the $6.3 billion and plans to restore withdrawals by Sunday. It has pledged to reimburse customers in full.

Luke

That's Binance's own account of its progress. The reporting here doesn't offer independent confirmation of the 90%, and it doesn't say how the last 10% gets filled.

Mark

Is the amount itself settled?

Luke

Not quite. The FBI says more than $6 billion. The $6.3 billion is the figure tied to Binance's statement.

Mimi

Still unknown are how the breach happened, when, and whether any funds have been frozen. Those are the things to look for next.

  • The FBI has formally pinned a roughly $6 billion crypto theft on North Korean hackers, raising the stakes of an already tense episode.
  • Binance customers are anxious about whether their losses will be made good, and withdrawals have been halted while the exchange works through the fallout.
  • Stolen funds are being converted into Ethereum, with investigators tracking a laundering path that is expected to run through DeFi and instant swap services.
  • Binance says it has covered about 90% of the $6.3 billion shortfall and plans to reopen withdrawals, with full reimbursement still the open promise.
  • Watchers are waiting to see whether the remaining gap closes and whether sanctions or seizures follow against the laundering channels.

On a Saturday, the American federal investigators named who they believe stole more than six billion dollars in digital currency from the exchange Binance: North Korean actors operating under the label TraderTraitor. The thieves are reportedly turning much of the haul into Ethereum, a common early step in moving stolen value out of sight, and investigators expect the trail to pass through decentralized finance and instant swap services. Binance, whose customers bear the human cost, says it has already covered about ninety percent of the loss and intends to make everyone whole, so the story now turns on whether that promise is kept.

On Saturday, the FBI stepped forward with a name for one of the largest cryptocurrency thefts on record. In a statement, the bureau said North Korea was behind the theft of more than $6 billion in digital assets from Binance, describing the attack as brazen.

The agency attributes the operation to a group it calls TraderTraitor. Working alongside the U.S. Secret Service and IRS Criminal Investigation, investigators have been following the money since it left the exchange. They have seen the stolen assets converted mainly into Ethereum, a typical first move in disguising where funds came from, and they expect the coins to be laundered further through DeFi platforms and instant swap services.

For Binance's customers, the pressing question is whether their money will come back. The exchange says it has covered about 90% of the $6.3 billion loss, plans to restore withdrawals by Sunday, and has pledged full reimbursement. The sources do not explain how the attack unfolded, when it occurred, how the remaining 10% will be handled, or whether any funds have been frozen or recovered. What comes next depends on whether Binance reopens withdrawals on time, closes the gap, and whether the FBI's attribution leads to sanctions or seizures against the laundering routes it has identified.

On Saturday, the FBI put a name to the culprit behind one of the largest cryptocurrency thefts on record. In a statement, the bureau said North Korea was responsible for stealing more than $6 billion in digital assets from Binance, in what it described as a brazen hacking attack.

The FBI attributed the theft to a group of actors it calls TraderTraitor. It said it was working with two partners: the U.S. Secret Service and IRS-CI, the criminal division of the Internal Revenue Service. Together, the agencies have been tracking what happens to the money after the theft.

According to the statement, they have observed TraderTraitor actors converting the stolen assets primarily into Ethereum. That is generally a first step in moving stolen funds, and the FBI said it expects what follows. The assets, it said, will then be laundered further through DeFi and instant swap services as the actors prepare them for later stages of laundering.

The figure at the center of the case is $6.3 billion, the amount Binance says was lost. The FBI's own wording is more cautious, putting the theft at more than $6 billion.

For Binance customers, the more immediate question has been whether they will get their money back. Earlier, the exchange said it had covered about 90% of the $6.3 billion loss. It also said it plans to restore withdrawals by Sunday. Binance has pledged to fully reimburse customers, and the 90% figure and the planned reopening of withdrawals are its markers of progress on that promise.

The source material does not say how the attack was carried out, when it happened, or how the remaining roughly 10% of the loss will be covered. It also does not say whether any of the stolen assets have been frozen or recovered.

What to watch next: whether Binance does restore withdrawals on schedule, whether it closes the remaining shortfall and completes full reimbursement, and whether the FBI's attribution is followed by sanctions or seizures aimed at the laundering channels it has described.

The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum.
— FBI statement, Saturday
Contattaci Domande frequenti