FBI Identifies North Korea Behind Record-Breaking $6.3 Billion Crypto Heist

[Dado Ruvic/Illustration/Reuters] The Federal Bureau of Investigation (FBI) has officially linked North Korea to the massive theft of virtual assets totaling a record $6.3 billion from the cryptocurrency exchange Binance. According to a statement released by the FBI on Saturday, malicious actors originating from North Korea were observed laundering the stolen assets, primarily by converting them into the cryptocurrency Ethereum. The US agency further attributed this operation to a group known as TraderTraitor, the same entity previously implicated in a $1.5 billion theft from the Bybit platform in February of last year. The FBI indicated that the assets are anticipated to undergo further laundering in stages. The agency has urged virtual asset service providers to block any transactions involved in the current laundering operation and has provided a list of suspected digital addresses for monitoring. In a separate announcement on Saturday, Binance stated that it has successfully replaced 90 percent of the stolen amount by utilizing company funds to acquire new tokens. The remaining 10 percent consists of less liquid tokens, which may require more time to repurchase. "We will continue to buy the remaining relevant token assets… until the covered amount reaches 100 [percent] for all tokens. Binance will absorb the financial impact of these stolen funds, not our users," the company communicated via X. The funds allocated for repurchasing tokens were drawn from Binance's Secure Asset Fund for Users (SAFU), a Bitcoin reserve fund established to protect customers during security breaches, as well as from its Futures Insurance Fund and corporate treasury. Crypto prices experienced a decline on Friday as Binance, the operator of the world's largest crypto exchange, worked to assure its customers of the safety of their funds. Binance co-CEO Richard Teng commented on Friday that the breach was a "complex attack" involving a compromised laptop and sophisticated malicious software designed to erase evidence of its activities, thereby complicating the investigation. Following the hack, the exchange temporarily suspended customer withdrawals. Binance later confirmed on Saturday that it was on schedule to resume withdrawals on Sunday. Additionally, Binance announced the release of a new proof-of-reserves snapshot, enabling users to independently verify that their assets are backed by a minimum 1:1 ratio.