On a Saturday that followed a swift and sweeping theft, the FBI named North Korean hackers as the likely authors of a $6.3 billion raid on Binance, the world's largest crypto exchange. The bureau tied the operation to TraderTraitor, the same group it associates with last year's $1.5 billion Bybit hack, casting the event as a larger echo of an earlier wound. Even as federal officials call for blocking the trail, the president's cautious doubts remind us that attribution in this strange new frontier of money is still a matter of patient proof, not instant certainty.
FBI Attributes $6.3 Billion Binance Theft to North Korean Hackers; Trump Says Attribution Is Unsettled
Bank robbery at the speed of the Internet
Mark
The FBI says North Korea did this. Why does the Bybit connection matter so much?
Mimi
Because it's how the bureau frames the attribution. It says TraderTraitor is the same group behind last year's $1.5 billion Bybit hack. That makes this look like a pattern, not a one-off.
Mark
And the money itself, what's the FBI doing about it?
Mimi
It's asking exchanges and blockchain analytics firms to block transactions linked to certain addresses. The group is mostly converting the loot to ethereum, and the FBI expects it to move next through DeFi and instant swap services.
Luke
Before we go further, the president said on Saturday night, "We don't know if it's North Korea." That's a public gap with the FBI's statement. He did add it could be determined later that it was.
Mark
So is the attribution shaky?
Luke
The reporting doesn't say. It says the FBI attributes it and that several crypto experts saw hallmarks of North Korea. It doesn't lay out the evidence, so we can't judge it from here.
Mimi
What we can say is that the FBI statement is on the record, and the president's remark is on the record, and they don't match.
Mark
Redbord called it a cat and mouse game. Does the money come back?
Luke
Nobody knows yet. He said funds can be traced in real time and possibly seized, and that laundering could take months. That's an expectation, not an outcome.
Mimi
For customers, Binance says it has reserves covering 90% of what was taken and promises full reimbursement. That's the company's own statement.
Luke
Right, and the 90% figure comes from Binance itself. The source doesn't say how the remaining 10% will be covered.
Der Puls
- Roughly $6.3 billion in digital currency vanished from Binance within minutes, and the crypto world is reeling.
- The FBI has publicly attributed the record heist to North Korean hackers linked to TraderTraitor.
- President Trump has signaled that investigators are not yet certain of North Korea's role, leaving the attribution contested.
- Exchanges and blockchain analysts are racing to freeze addresses and trace stolen ethereum before it is laundered through DeFi and instant swap services.
- Binance says reserves cover 90% of the missing assets and promises customers full reimbursement.
On a Saturday that followed a swift and sweeping theft, the FBI named North Korean hackers as the likely authors of a $6.3 billion raid on Binance, the world's largest crypto exchange. The bureau tied the operation to TraderTraitor, the same group it associates with last year's $1.5 billion Bybit hack, casting the event as a larger echo of an earlier wound. Even as federal officials call for blocking the trail, the president's cautious doubts remind us that attribution in this strange new frontier of money is still a matter of patient proof, not instant certainty.
On Saturday, the FBI stepped forward with a name for the people it believes emptied billions of dollars from Binance. In a statement, the bureau attributed the theft, the largest crypto heist ever recorded, to North Korean hackers acting under the label TraderTraitor. The attack had unfolded on Thursday, when some $6.3 billion in bitcoin and other digital currency left the world's largest crypto exchange. Several experts had said at the time that the operation bore the marks of North Korea, and the bureau's statement made that suspicion official.
The FBI also pointed to a precedent. TraderTraitor, it said, is behind the $1.5 billion hack of Bybit last year, and the Binance theft is a far larger repeat of that operation. Its investigation found the group converting stolen assets mainly into ethereum, and the bureau expects it to try moving the money through DeFi and instant swap services. The agency asked exchanges and analytics firms to block transactions linked to a list of addresses, so the funds cannot be laundered and their origins hidden.
The government did not speak with one voice. Asked about the case at a Halloween party at his Mar-a-Lago estate, President Trump said investigators did not yet know whether North Korea was involved, though it could still turn out to be.
For now, the story turns on the trail. Ari Redbord of TRM Labs expects the hackers to split the funds and push them through smaller exchanges, a process that could take months, yet he noted that the same tools that aid thieves can track the money in real time. Binance, for its part, says its reserves cover 90% of the missing assets and that customers will be fully reimbursed.
On Saturday, the FBI put a name to the people it says emptied billions of dollars from Binance in a matter of minutes. In a statement, the bureau attributed the theft, the largest crypto heist ever recorded, to North Korean hackers and tied the attack to what it called "malicious cyber activity" by an entity known as TraderTraitor.
The theft happened on Thursday. Some $6.3 billion in bitcoin and other digital currency left Binance, the world's largest crypto exchange. Several crypto experts said at the time that the attack bore the hallmarks of a North Korean operation, and the FBI's statement two days later made that attribution official.
The bureau pointed to a precedent. TraderTraitor, it said, is the same set of actors behind the $1.5 billion hack of the exchange Bybit last year. By the FBI's account, the Binance theft is a larger repeat of that earlier operation.
The statement also carried instructions. The FBI asked crypto exchanges, blockchain analytics companies and others to block transactions linked to a list of addresses, so the stolen money cannot be laundered and its origins hidden. Its investigation found that TraderTraitor was converting the stolen assets mainly into ethereum, and the bureau expects the group to try next to move the funds through DeFi and "instant swap services."
The federal government was not speaking with one voice, though. Reporters asked President Donald Trump about the case on Saturday night at a Halloween party at his Mar-a-Lago estate in Florida. He suggested investigators were not yet certain North Korea was involved. "I'm not concerned. We're learning about it," he said. "We don't know if it's North Korea." He added that it could still turn out to be.
Ari Redbord, chief policy officer at the blockchain intelligence firm TRM Labs, described what comes next. He expects the hackers to break the stolen assets into pieces and try to launder them through smaller exchanges to avoid detection, a process that could take months. He called the heist "bank robbery, in this case, at the speed of the Internet." But he said the same technology works in the other direction: "we can also track and trace those funds in real time in order to build investigations, to disrupt and to seize back funds." He summed up the dynamic as "a cat and mouse game."
For Binance's customers, the company offered reassurance on Saturday. It said it holds enough reserves, in the same digital currency that was stolen, to cover 90% of the missing assets, and it promised that customers would be fully reimbursed.
What to watch now is the laundering trail. The FBI's request to exchanges and analytics firms is aimed at closing off the routes the stolen ethereum is expected to take, while the question of official certainty about North Korea's role, raised by the president's remarks, remains open.
Bemerkenswerte Zitate
We don't know if it's North Korea.— President Donald Trump, at Mar-a-Lago on Saturday night
It's bank robbery, in this case, at the speed of the Internet.— Ari Redbord, chief policy officer, TRM Labs
Möchten Sie die ganze Geschichte?
Das Original lesen bei NBC 5 Chicago ↗
Politics & Governance