The Federal Bureau of Investigation (FBI) has officially attributed the massive Binance cryptocurrency theft to North Korean state-sponsored hackers. The agency is seeking assistance from the crypto community to prevent the laundering of the stolen funds.
Heist Details and Initial Attributions
The attack took place on October 29, when hackers accessed Binance’s hot wallets across various blockchains, extracting the funds in about 20 minutes. Binance has reported the theft at approximately $6.3 billion, marking it as the largest known cryptocurrency heist to date.
Blockchain intelligence companies TRM Labs and Chainalysis rapidly connected the heist to the North Korean group known as TraderTraitor. Initial investigations by Binance suggested a breach through a compromised DevOps engineer’s laptop, with the company committing to cover all losses from the incident.
FBI’s Findings and Warnings
On October 31, the FBI, along with the U.S. Secret Service and IRS Criminal Investigation, announced that TraderTraitor actors were converting the stolen assets mainly into Ethereum (ETH). The agency anticipated further laundering activities involving DeFi and instant swap services.
The FBI identified 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address linked to the theft. Agencies urged THORChain node operators, RPC node operators, instant exchanges, DeFi services, and blockchain analytics firms to block transactions associated with these addresses.
Ongoing Investigations and Binance’s Response
Binance has since found additional vulnerabilities beyond the initial compromised laptop. Richard Teng, Binance’s co-CEO, described the attack as sophisticated, involving multiple breach points and a self-destruct mechanism that erased evidence, complicating the investigation.
Despite these challenges, Binance resumed phased withdrawals on November 1, initially focusing on the Bitcoin network. By midday, the exchange processed roughly $4.6 billion in withdrawals and $1 billion in deposits, assuring users that Binance would absorb the financial losses.
Automated Laundering Efforts
Elliptic, a blockchain analytics firm, reports that the theft spanned 11 blockchains, totaling $6.43 billion. Of this, $2.85 billion has been frozen or seized. The attacker controls about $3.25 billion in unfreezable assets, distributed across more than 800 addresses.
Elliptic noted that the laundering process appears automated, with continuous fund distribution from main wallets, even when blocked by cross-chain bridges. The complexity and automation suggest a lengthy laundering process, echoing patterns from the previous Bybit hack attributed to the same group.
The crypto industry remains on high alert as investigations continue, aiming to prevent further laundering of the stolen assets.
