On a Saturday when the world's largest crypto exchange was still recovering from its losses, the FBI gave a name to the hand that had taken them. A record $6.3bn in digital assets vanished from Binance, and the agency attributes the theft to North Korean actors operating under the TraderTraitor label, the same group blamed for a far smaller but still enormous heist from Bybit the previous February. It is a reminder that in an economy built on code and trust, the most consequential crimes are often committed quietly, and that the recovery depends as much on who moves next as on who struck first
FBI Links North Korea's TraderTraitor to Record $6.3bn Binance Crypto Heist
The largest crypto theft on record now has a name attached to it.
Mark
Why does the FBI naming TraderTraitor matter beyond blame?
Mimi
Because it connects this theft to the Bybit one, $1.5bn in February last year. The FBI is describing one group working on a pattern, and the figures are getting bigger.
Mark
What is the FBI asking people to do?
Mimi
It wants virtual asset service providers to block transactions tied to the laundering, and it published the suspected addresses so they can check against them.
Luke
Worth being clear on what we know. The attribution is the FBI's statement. The reporting doesn't show the evidence behind it.
Mark
And the laundering?
Mimi
The FBI says the funds are mainly being converted to Ethereum and expects further laundering in stages. That is its expectation of what comes next.
Luke
Right, so the "further laundering" is a forecast, not an observed fact.
Mark
How did the breach happen?
Mimi
Co-CEO Richard Teng called it a complex attack involving a compromised laptop and malware designed to delete evidence of itself.
Luke
That is Binance's own description. Nothing independent has confirmed it yet.
Mark
What about the 90 percent coverage claim?
Mimi
Binance says it has bought replacement tokens using its $1bn SAFU fund, part of its Futures Insurance Fund and its corporate treasury. The last 10 percent is in less liquid tokens that take longer to buy.
Luke
Again, that is the company's figure. Reopening withdrawals on Sunday is a plan, not yet an event.
O Pulso
- A record $6.3bn was drained from Binance, and the exchange froze withdrawals while customers waited for answers.
- Binance's co-CEO described a complex attack through a compromised laptop, with malware designed to erase its own tracks.
- The FBI tied the theft to TraderTraitor and is racing to get exchanges to block the laundering addresses it has published.
- Binance has replaced 90 percent of the stolen value from its SAFU reserve and corporate funds, with the remaining 10 percent still being bought.
- Withdrawals are set to reopen Sunday, but the stolen funds are still moving through laundering stages toward Ethereum.
On a Saturday when the world's largest crypto exchange was still recovering from its losses, the FBI gave a name to the hand that had taken them. A record $6.3bn in digital assets vanished from Binance, and the agency attributes the theft to North Korean actors operating under the TraderTraitor label, the same group blamed for a far smaller but still enormous heist from Bybit the previous February. It is a reminder that in an economy built on code and trust, the most consequential crimes are often committed quietly, and that the recovery depends as much on who moves next as on who struck first.
On Saturday, the FBI publicly named North Korean actors as responsible for the theft of $6.3bn in virtual assets from Binance, the exchange that runs the world's largest crypto trading platform. The agency pointed to TraderTraitor, the same group it had blamed for a $1.5bn theft from Bybit the previous February. Investigators observed the thieves converting the stolen assets mainly into Ethereum, and the FBI expects the funds to be laundered further in stages.
The agency urged virtual asset service providers to block transactions tied to the operation and shared the suspected digital addresses to watch for. Its statement arrived a day after Binance had described the breach on Friday. Co-CEO Richard Teng called it a complex attack involving a compromised laptop and malicious software built to erase evidence of its own activity, which made the intrusion hard to trace. Withdrawals were halted afterward, and crypto prices fell as the exchange worked to reassure users their money was safe.
On Saturday, Binance said it had already replaced 90 percent of the stolen amount using company money, mainly from the Secure Asset Fund for Users, a $1bn Bitcoin reserve held to protect customers. The remaining 10 percent is in less liquid tokens that may take longer to buy, and the company pledged to keep purchasing until coverage is complete, with Binance rather than its users bearing the loss. Withdrawals are expected to reopen Sunday, alongside a new proof-of-reserves snapshot that lets users verify their assets are backed at least 1:1. The open questions are whether the promised reopening holds and whether other platforms act on the FBI's list before more of the money moves on.
On Saturday, the FBI put a name to the group behind the largest crypto theft on record. In a statement, the agency said North Korean actors were responsible for the theft of $6.3bn in virtual assets from Binance, the exchange that runs the world's largest crypto trading platform.
The FBI pointed specifically to TraderTraitor, the same group it blamed for the $1.5bn theft from the Bybit platform in February last year. According to the agency, the thieves were observed laundering the stolen assets by converting them mainly into Ethereum. The statement added that the funds are expected to be "further laundered" in stages.
The FBI asked virtual asset service providers to block transactions tied to the laundering operation. To help them, it supplied the suspected digital addresses to watch for.
Binance's account of the breach came a day earlier. Co-CEO Richard Teng said on Friday that it was a "complex attack" involving a compromised laptop and malicious software built to delete evidence of its own activity, which made the intrusion hard to trace and investigate. After the hack, the exchange stopped customers from withdrawing their funds. Crypto prices fell on Friday as Binance tried to reassure users that their money was safe.
In a separate statement on Saturday, Binance said it had already replaced 90 percent of the stolen amount by using company money to buy new tokens. The remaining 10 percent is made up of less liquid tokens, which the company said may take longer to purchase. On X, it said it would keep buying the relevant token assets until coverage reaches 100 percent for all tokens, and that Binance, not its users, would absorb the financial impact.
The money for the replacement purchases came from several places. The main source was the Secure Asset Fund for Users, known as SAFU, a $1bn Bitcoin reserve Binance holds to protect customers in the event of security breaches. The company also drew on part of its Futures Insurance Fund and on its corporate treasury.
Binance said later on Saturday that it was on track to reopen withdrawals on Sunday. It also announced a new proof-of-reserves snapshot, which lets users independently verify that their assets are backed at a minimum ratio of 1:1.
Two things to watch now: whether withdrawals reopen as promised, and whether other platforms act on the FBI's list of addresses before more of the stolen funds are moved through the laundering stages the agency expects.
Citações Notáveis
Binance will absorb the financial impact of these stolen funds, not our users.— Binance, statement on X
The breach was a complex attack involving a compromised laptop and malicious software designed to delete evidence.— Richard Teng, Binance co-CEO (paraphrased)
Quer a matéria completa?
Leia o original em Al Jazeera ↗