On a Saturday, the FBI placed its name to an accusation that a theft of billions from the Binance exchange, completed in minutes, was the work of North Korean hackers operating under the name TraderTraitor, the same group previously linked to the 2025 Bybit theft. It is the sort of quiet, digital robbery that belongs to an age where value moves at the speed of a keystroke, and where the chase after it unfolds on the same ledgers. Yet the story is not settled: the President, speaking at a party that evening, said only that no one yet knew whether North Korea was involved, leaving the official w
FBI Attributes Binance Crypto Theft to North Korean Hackers TraderTraitor, as Trump Says Attribution Unconfirmed
Bank robbery, at the speed of the Internet
Mark
Start with the basics. What is the FBI actually claiming here?
Mimi
That the Binance theft, which it calls the biggest crypto heist ever, was run by TraderTraitor, a North Korean entity. It's the same group the bureau links to the $1.5 billion Bybit hack in 2025.
Mark
And Binance's users, are they out of pocket?
Mimi
Binance says no. It has replaced 90 per cent of what was stolen and says it will cover the other 10, which is in less liquid tokens that take longer to buy.
Luke
Worth noting that's Binance's own statement. We don't have an independent accounting, and the report doesn't give the total beyond "billions."
Mark
Then there's Trump saying he doesn't know if it's North Korea.
Mimi
He said "we're learning about it" and allowed it might turn out to be. It's a different tone from the FBI's statement.
Luke
Right, and the reporting can't tell us why. It might be caution, it might be that he wasn't briefed. All we have is two public positions that don't match.
Mark
What does the FBI want done now?
Mimi
Exchanges and analytics firms are asked to block transactions tied to certain addresses. The bureau expects the hackers to move the ethereum through DeFi and instant swap services.
Mark
How long could this take?
Mimi
Ari Redbord of TRM Labs says laundering through smaller exchanges could stretch over months, but that funds can also be traced in real time.
Luke
That's one expert's expectation, not a forecast anyone can promise. Whether any money is seized back is unknown.
The Pulse
- The FBI has tied a record-breaking Binance theft, carried out in minutes, to North Korean hackers known as TraderTraitor.
- The attribution stands uneasily beside President Trump's remark that it is not yet known whether North Korea was involved.
- Binance has replaced 90 per cent of the stolen assets and promised to cover the remainder, which consists of harder-to-buy tokens.
- Investigators are asking exchanges and analytics firms to freeze transactions tied to listed addresses before the money can be laundered.
- The stolen ethereum may be broken into pieces and pushed through DeFi and swap services over months, a race that is now being tracked in real time.
On a Saturday, the FBI placed its name to an accusation that a theft of billions from the Binance exchange, completed in minutes, was the work of North Korean hackers operating under the name TraderTraitor, the same group previously linked to the 2025 Bybit theft. It is the sort of quiet, digital robbery that belongs to an age where value moves at the speed of a keystroke, and where the chase after it unfolds on the same ledgers. Yet the story is not settled: the President, speaking at a party that evening, said only that no one yet knew whether North Korea was involved, leaving the official word and the political word standing apart.
On Saturday, the FBI said that a theft of billions of dollars from Binance, carried out within minutes and described as the largest crypto heist in history, had been orchestrated by North Korean hackers. The bureau linked the attack to a group called TraderTraitor, the same actors behind the $1.5 billion hack of Bybit in 2025.
The agency's statement was also a call to action. It asked exchanges, blockchain analytics firms and others to block transactions tied to a set of addresses, so the stolen funds could not be washed clean. Its investigation found the group had been converting the assets mainly into ethereum, and it expects them to turn next to DeFi and instant swap services.
Binance said it had already replaced 90 per cent of the stolen amount, with the remaining 10 per cent made up of less liquid tokens that may take longer to acquire. Co-CEO Richard Teng promised that users would not bear the financial impact.
That evening, President Trump, speaking to reporters at Mar-a-Lago, sounded less certain. He said he was not concerned and that it was still unclear whether North Korea was responsible, though that might yet be determined. The FBI's claim and the president's hesitation remain unreconciled.
Analysts expect the laundering to play out slowly, through smaller exchanges over months. Ari Redbord of TRM Labs described it as bank robbery at the speed of the internet, but noted that the funds can also be traced in real time. It is, he said, a cat and mouse game. What comes next depends on whether exchanges block the listed addresses, how fast the ethereum moves, and whether the administration's position catches up with the bureau's.
The FBI said in a statement on Saturday that the theft of billions of dollars from Binance, carried out within a matter of minutes and described as the biggest crypto heist in history, was orchestrated by North Korean hackers.
The bureau tied the attack to what it called "malicious cyber activity" by an entity known as TraderTraitor. That is the same group behind the $US1.5 billion ($A2.1 billion) hack of the exchange Bybit in 2025.
The FBI's statement also carried instructions. It asked crypto exchanges, blockchain analytics companies and others to block transactions linked to a set of addresses, so the money could not be laundered in a way that hides where it came from. Its investigation found that TraderTraitor was converting the stolen assets mainly into ethereum. The bureau expects the group to try next to convert the assets using DeFi and "instant swap services".
Binance, for its part, said it had replaced 90 per cent of the amount stolen. In a statement posted on X, it said the remaining 10 per cent consists of less liquid tokens, which may take longer to buy. Co-CEO Richard Teng wrote on X: "We've now replenished 90% of the stolen assets, and we're committed to covering the remaining 10%. Our users will not bear the financial impact of this incident."
The attribution was not stated so firmly everywhere. On Saturday night, President Donald Trump was asked about the case by reporters at a Halloween party at his Mar-a-Lago estate in Florida. He suggested investigators were not yet certain North Korea was involved. "I'm not concerned. We're learning about it," he said, and then: "We don't know if it's North Korea." He added that it could yet be determined that it was.
The FBI's statement and the president's remarks sit side by side, unreconciled. The bureau names TraderTraitor; Trump says the question is still open.
Looking ahead, crypto expert Ari Redbord, chief policy officer at blockchain intelligence firm TRM Labs, expects the hackers to break the stolen assets into pieces and try to launder them through smaller exchanges to evade detection. He said that process could unfold over months. "It's bank robbery, in this case, at the speed of the Internet," he said. He also pointed to the other side of the ledger: "We can also track and trace those funds in real time in order to build investigations, to disrupt and to seize back funds." His summary: "It's just this cat and mouse game."
What to watch is whether exchanges act on the FBI's request to block the listed addresses, how fast the stolen ethereum moves through swap services, and whether the administration's public position comes to match the bureau's.
Notable Quotes
We don't know if it's North Korea.— President Donald Trump, at Mar-a-Lago
We've now replenished 90% of the stolen assets, and we're committed to covering the remaining 10%.— Richard Teng, Binance co-CEO, on X
Want the full story?
Read the original at PerthNow ↗
Politics & Governance