On a Saturday, the federal government put a name to what may be the largest cryptocurrency theft on record, pointing to a North Korean-linked group that had already struck once before at the exchange Bybit. The attribution arrives in the familiar shape of a hidden hand moving through the digital ledger of global finance, where value can vanish in minutes and be chased for months. Yet the same day brought a note of uncertainty from the nation's leader, leaving the story suspended between a written accusation and a public admission that the full picture is not yet known.
FBI Attributes Record Binance Crypto Heist to North Korean Hackers; Trump Says Attribution Unsettled
"We don't know if it was North Korea."
On a Saturday, the federal government put a name to what may be the largest cryptocurrency theft on record, pointing to a North Korean-linked group that had already struck once before at the exchange Bybit. The attribution arrives in the familiar shape of a hidden hand moving through the digital ledger of global finance, where value can vanish in minutes and be chased for months. Yet the same day brought a note of uncertainty from the nation's leader, leaving the story suspended between a written accusation and a public admission that the full picture is not yet known.
On Saturday, the FBI announced that North Korean hackers were behind the heist at Binance, the largest cryptocurrency theft ever recorded. Billions of dollars were taken in a matter of minutes, and the bureau tied the attack to a group it calls TraderTraitor, the same actors it links to last year's $1.5 billion hack of the exchange Bybit. In the bureau's account, Binance was not a one-off but a second and far larger strike.
The FBI did more than assign blame. It asked exchanges, blockchain analytics firms and others to block transactions connected to a set of identified addresses, hoping to stop the stolen money from being laundered and placed beyond recovery. It also reported that the funds were being converted mainly into ethereum, and it expects the group to push them further through decentralized finance and instant swap services.
Later that night, President Donald Trump offered a more cautious note, saying authorities were still learning about the case and that "we don't know if it was North Korea." The distance between his remark and the bureau's written statement, issued the same day, is now part of the story. What remains unknown is how the attackers got in, whether any funds have been frozen or recovered, and how the money will be traced from here.
On Saturday, the FBI put a name to the group it says is behind the largest cryptocurrency theft ever recorded. In a statement, the bureau said North Korean hackers orchestrated the heist at Binance, in which billions of dollars were taken within a matter of minutes.
The FBI tied this week's attack to what it called malicious cyber activity by an entity known as TraderTraitor. That is the same group the bureau links to last year's hack of the exchange Bybit, which cost that platform $1.5 billion. By the bureau's account, the Binance theft is a second, far larger strike by the same actors.
The statement was not only an attribution. The FBI asked crypto exchanges, blockchain analytics companies and other firms to block transactions linked to a set of addresses it identified. The aim is to keep the stolen money from being laundered, a process that would obscure where it came from and put it beyond recovery.
The bureau also described what its investigation had found so far about the movement of the funds. TraderTraitor, it said, was converting the stolen assets primarily into ethereum. Looking ahead, the FBI said it expects the group to try to convert the assets further using decentralized finance, known as DeFi, and what it called instant swap services.
Later Saturday night, President Donald Trump offered a different note. He said authorities were still learning about the case and added, "We don't know if it was North Korea." His remark leaves a visible gap between the president's public caution and the FBI's written statement, issued the same day.
The source reporting, from The Associated Press, does not give a total for the amount stolen beyond "billions," and it does not detail how the attackers got into Binance or how the theft unfolded. It also does not say whether any of the money has been frozen or recovered.
What the FBI has laid out is a request for cooperation and a forecast. The request is for platforms to block the flagged addresses. The forecast is that the stolen funds will pass through DeFi and instant swap channels. Those are the places to watch as investigators try to trace the money, and as the administration's own position on who is responsible becomes clearer.
Citations marquantes
We don't know if it was North Korea.— President Donald Trump
The attack was tied to malicious cyber activity by an entity known as TraderTraitor.— FBI statement