On a Saturday night, between a Halloween party and a Florida estate, a question about the largest cryptocurrency theft ever recorded drew two answers that did not match. The FBI had named North Korean hackers, operating under the name TraderTraitor, as the force behind the $6.3 billion taken from Binance, the world's largest crypto exchange, in a matter of minutes earlier in the week. The President, asked the same question, said he was not concerned and that it remained unknown whether Pyongyang was responsible, leaving the attribution suspended between a federal finding and a political shrug.
FBI Links $6.3 Billion Binance Heist to North Korean Hackers as Trump Says Attribution Is Unsettled
Bank robbery at the speed of the Internet
The FBI named North Korea on Saturday. Why does it matter that Trump said something different that night?
Because the two statements came within hours of each other. The bureau tied the theft to TraderTraitor, the group behind the $1.5 billion Bybit hack last year. Trump said "we don't know if it's North Korea," though he allowed it might turn out to be.
Worth being precise here. The FBI's statement is an attribution, and we haven't been shown the evidence behind it. Trump's comment doesn't tell us what he knows or doesn't know. He said they're still learning.
What is the FBI actually asking people to do?
It wants exchanges, blockchain analytics firms and others to block transactions tied to certain addresses, so the money can't be laundered and its origins hidden.
And that's a request, not an order. We don't know how many companies will comply or how fast.
What happens to the money now?
The FBI says it's being converted mainly into ethereum, and it expects the next step to be DeFi and instant swap services. Ari Redbord of TRM Labs expects it to be split up and run through smaller exchanges, possibly over months.
That's one expert's expectation of how it will unfold. Nobody has reported that it's happening yet, and the timeline is a guess.
Are Binance customers out any money?
Binance says it has reserves in the same currency covering 90% of what was taken, and it promised full reimbursement.
That's the company's own statement. The source doesn't say how the remaining 10% will be covered or when customers will be repaid.
Der Puls
- The FBI names North Korean actors as the culprits while the President says he does not know, and the gap between those two positions is itself a source of tension.
- In minutes, $6.3 billion in bitcoin and other digital assets vanished from Binance, a theft now measured against last year's $1.5 billion Bybit hack and found to be more than four times larger.
- Federal investigators are pressing exchanges and blockchain analysts to block flagged addresses before stolen ethereum can be laundered through DeFi and instant swap services.
- Binance says reserves cover 90% of the missing assets and promises full reimbursement, while tracers race to follow the funds, which may be split into small pieces over months.
On a Saturday night, between a Halloween party and a Florida estate, a question about the largest cryptocurrency theft ever recorded drew two answers that did not match. The FBI had named North Korean hackers, operating under the name TraderTraitor, as the force behind the $6.3 billion taken from Binance, the world's largest crypto exchange, in a matter of minutes earlier in the week. The President, asked the same question, said he was not concerned and that it remained unknown whether Pyongyang was responsible, leaving the attribution suspended between a federal finding and a political shrug. In the larger story of digital money, it is a reminder that theft now moves at the speed of networks, and that the work of tracing it back is slower, quieter, and still unfinished.
On Saturday night, at a Halloween party at his Mar-a-Lago estate, President Donald Trump was asked about the largest cryptocurrency theft on record. He said he was "not concerned" and that "we don't know if it's North Korea," even though the FBI had announced earlier that day that North Korean hackers were responsible.
The $6.3 billion in bitcoin and other digital currency was taken from Binance on Thursday, in a operation that unfolded within minutes. Crypto experts had said at the time that it bore the marks of North Korea. The FBI tied it to a group called TraderTraitor, the same actors it linked to last year's $1.5 billion Bybit hack.
The bureau has asked exchanges and analytics firms to block addresses it identified, and it expects the stolen funds to move next through DeFi platforms and instant swap services. Ari Redbord of TRM Labs expects the thieves to split the money into smaller pieces and route it through small exchanges, a process that could take months. Yet he also noted that the funds can be tracked in real time, giving investigators a chance to seize them back.
For Binance customers, the company holds enough of the same digital currency to cover 90% of the missing assets and has promised full reimbursement. What remains to be seen is whether the flagged addresses get frozen and whether any money can be recovered before it disperses.
On Saturday night, at a Halloween party at his Mar-a-Lago estate in Florida, President Donald Trump was asked by reporters about the largest cryptocurrency theft on record. His answer cut against what the FBI had said earlier the same day. "I'm not concerned. We're learning about it," he said, adding that "we don't know if it's North Korea," though he allowed that it could still be determined that it was.
The FBI had put out a statement on Saturday attributing the theft to North Korean hackers. The money, $6.3 billion in bitcoin and other digital currency, was taken from Binance, the world's largest crypto exchange, on Thursday. The theft played out within a matter of minutes. Several crypto experts said at the time that it bore the hallmarks of a North Korean operation.
The bureau tied the attack to "malicious cyber activity" by an entity known as TraderTraitor. The same actors, the FBI said, were behind a $1.5 billion hack of the exchange Bybit last year. That earlier case now serves as the reference point for this one, which is more than four times larger.
The FBI also made specific requests of the industry. It asked crypto exchanges, blockchain analytics companies and others to block transactions linked to a set of addresses it identified, so the stolen funds cannot be laundered and their origins disguised. Its investigation found that TraderTraitor was converting the stolen assets primarily into ethereum. The bureau expects the group to try next to move the assets through DeFi and "instant swap services."
Ari Redbord, chief policy officer at the blockchain intelligence firm TRM Labs, expects the hackers to break the loot into smaller pieces and push it through smaller exchanges to avoid detection. He said that process could unfold over months. "It's bank robbery, in this case, at the speed of the Internet," he said. But he pointed to the other side of the ledger: "we can also track and trace those funds in real time in order to build investigations, to disrupt and to seize back funds." He described the whole effort as "just this cat and mouse game."
For Binance customers, the company said on Saturday that it holds enough in the same digital currency that was stolen to cover 90% of the missing assets. It promised that customers would be fully reimbursed.
So the record stands at an FBI attribution to TraderTraitor, a president who says the question is open, and a laundering effort that analysts expect to last months. What to watch is whether exchanges freeze the flagged addresses, and whether any of the stolen funds can be seized back before they are dispersed.
Bemerkenswerte Zitate
I'm not concerned. We're learning about it. We don't know if it's North Korea.— President Donald Trump, at Mar-a-Lago
It's bank robbery, in this case, at the speed of the Internet.— Ari Redbord, chief policy officer at TRM Labs