FBI Ties Binance Theft to North Korea
The FBI says a North Korean hacking unit took more than $6 billion from the world's largest crypto exchange, and asks the industry to block the wallets moving it.
The FBI's J. Edgar Hoover Building in Washington, June 2024.Illustration by The Good Times, based on a photo by ajay_suresh / Wikimedia Commons (CC BY 2.0)
The FBI says North Korea stole more than $6 billion in digital currency from Binance, the world's largest cryptocurrency exchange. The bureau tied the attack to TraderTraitor, the North Korean unit it blamed for the $1.5 billion Bybit theft last year, and asked exchanges, blockchain analytics firms and other crypto businesses to block transactions linked to the wallets the hackers are using. Most of the money left Binance wallets in about 20 minutes. The FBI, working with the Secret Service and the IRS, said the hackers were turning the stolen coins mainly into ether. Stablecoin issuers led by Tether and Circle froze nearly $2.7 billion within hours, by TRM Labs' count, or about $2.8 billion by Chainalysis'. It is the largest theft in the history of cryptocurrency, about four times the Bybit loss. North Korea routinely denies involvement in cyberattacks.
The FBI has blamed a North Korean hacking unit for stealing more than $6 billion from Binance, the largest crypto theft on record, and is asking crypto businesses to block the wallets the hackers are using.
What the FBI said
The FBI says North Korea stole more than $6 billion in digital currency from Binance, the world's largest cryptocurrency exchange, and named the unit behind it as TraderTraitor. The bureau linked the same group to the $1.5 billion theft from the exchange Bybit last year. Working with the Secret Service and the IRS criminal investigation division, the FBI said it had seen the hackers converting the stolen assets mainly into ether, and expects them to try to launder the money next through decentralized finance platforms and instant swap services. The agencies asked exchanges, blockchain analytics firms and other crypto businesses to block transactions involving the wallet addresses tied to the hackers.
How the money moved
The theft began on Oct. 29. Funds left Binance wallets across ten blockchains, by TRM Labs' count, most of it in about 20 minutes, according to TRM Labs and Chainalysis, two blockchain analytics firms. TRM Labs says the attackers compromised the systems Binance uses to sign and authorize transactions, which let them send instructions that emptied the affected wallets. The exchange suspended withdrawals on several networks.
The race to freeze
Stablecoin issuers moved to freeze what they could. TRM Labs counted nearly $2.7 billion frozen within hours, led by Tether and Circle; Chainalysis put the figure at about $2.8 billion. The attackers swapped stablecoins, which their issuers can freeze, into ether, which has no issuer to freeze it. Both firms attributed the theft to TraderTraitor before the FBI did.
The size of it
The theft is about four times the Bybit loss, which had been the record. North Korea has routinely denied carrying out such attacks.