FBI Attributes Record $6.3 Billion Binance Crypto Theft to North Korean Hackers, Trump Urges Caution

On Saturday, the FBI put a name to the group it says emptied billions of dollars from Binance in a matter of minutes. In a statement, the bureau said this week's theft was tied to "malicious cyber activity" by an entity known as TraderTraitor, a North Korean-linked group. It is the same actor the bureau connected to the $1.5 billion Bybit hack last year.

The theft itself took place on Thursday. Some $6.3 billion in bitcoin and other digital currency left Binance, the world's largest crypto exchange. Several crypto experts said at the time that the attack bore the hallmarks of a North Korean operation. It is described as the biggest crypto heist in history.

The FBI's statement was as much a request as an attribution. The bureau asked crypto exchanges, blockchain analytics companies and others to block transactions linked to a set of addresses, so the money cannot be laundered and its origins hidden. It also said its investigation found that TraderTraitor was converting the stolen assets mainly into ethereum. The bureau expects the group's next step to be converting those assets through DeFi and "instant swap services."

That same night, President Donald Trump struck a more cautious note. Reporters asked him about the case as he appeared at a Halloween party at his Mar-a-Lago estate in Florida. He suggested investigators were not yet certain North Korea was involved. "I'm not concerned. We're learning about it," he said, and then: "We don't know if it's North Korea." He added that it could still be determined that it was.

Ari Redbord, chief policy officer at the blockchain intelligence firm TRM Labs, said he expects the hackers to break the stolen assets into pieces and try to launder them through smaller exchanges to evade detection. That process, he said, could unfold over months. He described the crime as "bank robbery, in this case, at the speed of the Internet." But he said the same technology cuts the other way: funds can be tracked and traced in real time, which lets investigators build cases, disrupt the laundering and seize money back. "It's just this cat and mouse game," he said.

For Binance's customers, the more immediate question is whether they will be made whole. On Saturday the company said it holds enough in reserve, in the same digital currency that was stolen, to cover 90% of the missing assets. It promised that customers would be fully reimbursed.

So two things are in motion at once. The FBI has made a firm public attribution and is asking the industry to freeze the trail. The president, speaking the same day, left the question of responsibility open. What to watch is whether exchanges block the flagged addresses, and whether any of the funds surface and can be recovered as the laundering plays out over the coming months.