A vast sum has vanished from the largest crypto exchange in the world, and within days the story has already acquired a shape: a state-backed hacking group, a government naming its suspect, and a company quietly refilling the empty vault from its own reserves. It is the modern version of an old human pattern, where the thief is known faster than the loss is repaid, and trust is rebuilt not by promises but by the visible movement of money back to where it belongs. Whether that repair holds will depend on the slower work of tracing where the stolen value now travels.
FBI Blames North Korea's TraderTraitor for $6.3B Binance Hack; Exchange Replaces 90% of Stolen Funds
The biggest crypto heist in history, and the FBI names North Korea
Mark
Start with the basics. Who does the FBI say did this?
Mimi
A state-backed group called TraderTraitor, which it ties to North Korea. The same group was blamed for the $1.5 billion Bybit hack last year.
Mark
And Binance says customers are covered?
Mimi
Teng says 90% of the stolen assets have been replaced with company money, and the other 10% will be covered. Withdrawals were halted after Thursday's attack and are meant to reopen Sunday.
Luke
Let me separate two things. The 90% figure is Binance's own statement, and so is the claim that users bear no impact. The attribution to North Korea is the FBI's. Those are different kinds of claims from different sources.
Mark
Where did the replacement money come from?
Mimi
The $1 billion SAFU fund, the Futures Insurance Fund, and the corporate treasury. Binance says it set aside about $6.34 billion.
Luke
Worth noting the SAFU fund alone is a fraction of that. How much came from each source isn't broken down.
Mark
What's the FBI worried about now?
Mimi
Laundering. The hackers have started converting funds, mainly into Ethereum, and the bureau says they may use DeFi platforms and instant swaps. It wants exchanges and tracking firms to block flagged wallet addresses.
Luke
And whether any of that blocking works, or how much has been moved, isn't reported yet. Same for the full details of how the laptop was compromised beyond Teng's description.
Der Puls
- A $6.3 billion theft, billed as the largest crypto heist ever, has shaken confidence in one of the world's biggest exchanges.
- The FBI has named North Korea-linked TraderTraitor as the culprit, tying this attack to a prior $1.5 billion breach.
- Binance halted withdrawals after the attack, and its co-CEO says it has already replaced 90% of the lost assets.
- Stolen funds are being converted into Ethereum, and investigators fear they will be pushed through DeFi platforms and instant swaps.
- The race now is between laundering routes and blocked wallet addresses, with the final 10% of recovery still unresolved.
A vast sum has vanished from the largest crypto exchange in the world, and within days the story has already acquired a shape: a state-backed hacking group, a government naming its suspect, and a company quietly refilling the empty vault from its own reserves. It is the modern version of an old human pattern, where the thief is known faster than the loss is repaid, and trust is rebuilt not by promises but by the visible movement of money back to where it belongs. Whether that repair holds will depend on the slower work of tracing where the stolen value now travels.
On Saturday, two days after the theft, Richard Teng, co-CEO of Binance, reached out to customers on X with a reassurance: the exchange had already put back most of what had been taken. By then the FBI had already pointed at who it believed was responsible, a state-backed hacking group called TraderTraitor, which it links to North Korea.
The attack struck on Thursday and was described as the largest crypto heist on record. The bureau noted the group had also been blamed for a $1.5 billion hack of Bybit the year before. Investigators believe the hackers had begun converting the stolen money, mostly into Ethereum, and warned they could use decentralised finance platforms and instant swap services to make the funds harder to follow. Exchanges and tracking firms were asked to block transactions linked to flagged wallet addresses.
Binance said it had replaced 90% of the missing assets by buying new tokens with its own money, drawing on its Secure Asset Fund for Users, its Futures Insurance Fund and its corporate treasury. The remaining 10% involves less liquid coins that will take longer to replace. Teng promised that users would not bear the financial impact. Withdrawals, paused after the breach, were expected to reopen on Sunday, and a fresh proof-of-reserves snapshot is being prepared so users can verify their holdings.
What remains is the uncertain part: whether the stolen Ethereum resurfaces in laundering channels, and whether the flagged addresses can be frozen before it does.
On Saturday, two days after the theft, Binance's co-CEO Richard Teng posted a message on X telling customers that the world's largest cryptocurrency exchange had already put back most of what was taken. By then the FBI had named who it believed was responsible: North Korea.
The bureau said the $6.3 billion theft, described as the biggest crypto heist in history, was the work of TraderTraitor, a state-backed hacking group. The attack took place on Thursday. The FBI called it part of the group's ongoing malicious cyber activity and noted that TraderTraitor was previously blamed for a $1.5 billion hack of the cryptocurrency exchange Bybit last year.
According to the FBI, its investigation found that the hackers had already begun converting the stolen funds, mainly into Ethereum, another major cryptocurrency. The bureau warned that the group could use decentralised finance platforms and instant swap services to move the assets and make them harder to trace.
The FBI also asked cryptocurrency exchanges, blockchain tracking firms and other organisations to block transactions tied to wallet addresses identified in its investigation. The aim is to stop the stolen money from being laundered.
Binance, for its part, said it had recovered or replaced 90% of the stolen amount by buying new tokens with company money. The remaining 10% involves less liquid cryptocurrencies, which may take longer to replace. "We've now replenished 90% of the stolen assets, and we're committed to covering the remaining 10%. Our users will not bear the financial impact of this incident," Teng wrote.
The exchange said it had set aside about $6.34 billion in company funds to cover the losses. The replacement tokens were bought with money from three sources: its $1 billion Secure Asset Fund for Users, known as SAFU; its Futures Insurance Fund; and its corporate treasury.
After Thursday's attack, Binance temporarily halted customer withdrawals. On Saturday it said it remained on track to reopen them on Sunday. Teng had earlier described the breach as a complex attack involving a compromised laptop and malicious software built to erase evidence of its activity.
Binance also said it had taken a fresh snapshot of customer assets as part of its proof-of-reserves process. When the full report is available, users holding 10 listed cryptocurrencies, including Bitcoin, Ethereum, Tether, BNB and Solana, will be able to check whether their holdings are backed at a minimum ratio of 1:1.
What to watch next: whether the stolen Ethereum moves through DeFi platforms or instant swap services, and whether exchanges block the wallet addresses the FBI has flagged, as the bureau's investigation into the funds continues.
Bemerkenswerte Zitate
We've now replenished 90% of the stolen assets, and we're committed to covering the remaining 10%. Our users will not bear the financial impact of this incident.— Richard Teng, Binance co-CEO, on X
Möchten Sie die ganze Geschichte?
Das Original lesen bei Hindustan Times ↗
Business