FBI links $6 billion Binance theft to North Korea

The FBI says North Korea was responsible for stealing more than $6 billion in crypto from Binance on Oct. 29, making the breach a record-setting theft and putting a state-backed hacking group at the centre of the investigation. The agency named the group TraderTraitor in its cyber alert dated Oct. 31.

Binance has said it will cover users’ losses. The case also shows how a security breach at an exchange can put funds across many crypto networks at risk.

How much was taken, and how much has been frozen?

Binance put the loss at about $6.3 billion, while blockchain analytics firm Elliptic estimated $6.43 billion across 11 networks. Elliptic says the attacker drained the exchange’s hot wallets—online wallets used to move funds—over several hours on Oct. 29.

Elliptic counted $3.80 billion taken from Ethereum wallets and 18,270 bitcoin, worth about $1.48 billion at the time. The FBI says the stolen assets were being converted mainly into ether. It warned that the group could move funds through crypto swapping services and decentralized finance platforms, where users trade without a traditional intermediary.

Elliptic reported that $2.85 billion had been frozen or seized by Nov. 1, about 44% of its estimated total. That figure may change as investigators trace the remaining assets.

What does the FBI say about who carried out the attack?

The FBI attributed the theft to TraderTraitor, a name it uses for this North Korean cyber activity. The agency said it was working with the U.S. Secret Service and the IRS’s criminal investigation unit to track the stolen funds. It asked crypto businesses and service providers to block transactions tied to wallet addresses listed in its alert.

Elliptic’s account of the attack points to Binance’s transaction-signing systems. It says the attacker used a smart contract—a program on a blockchain—to gain control of a Binance wallet’s transaction permissions, then moved funds from it. Binance said its investigation found additional points of breach and described the incident as a complex attack.

Are Binance withdrawals back?

Binance began reopening withdrawals on Nov. 1, starting with the Bitcoin network, according to Elliptic’s incident update. The exchange said it had reserved more than $6.34 billion in company funds to cover the stolen assets, according to Elliptic.

The FBI’s attribution identifies the group it holds responsible, but tracing and freezing the remaining funds is still underway. The agency urged exchanges, blockchain operators and other crypto services to watch for transactions linked to the listed addresses.

Sources

• cyber alert — fbi.gov
• Elliptic’s incident update — elliptic.co