The attribution is significant because it places the heist within a pattern of state-linked crypto crime rather than ordinary fraud, and because the sums involved now dwarf earlier incidents.
The FBI has linked North Korea to the theft of a record $6.3bn in virtual assets from the cryptocurrency exchange Binance, according to Al Jazeera. In a statement on Saturday, the US agency said malicious actors from North Korea were observed laundering the stolen assets by converting them primarily into Ethereum. The operation was attributed specifically to a group called TraderTraitor, the same group blamed for a $1.5bn theft from the Bybit platform in February last year.
According to the statement, the assets are expected to be further laundered in stages. The FBI called on virtual asset service providers to block transactions being used in the latest laundering operation, and provided the suspected digital addresses to watch for. The attribution is significant because it places the heist within a pattern of state-linked crypto crime rather than ordinary fraud, and because the sums involved now dwarf earlier incidents.
Binance, in a separate statement on Saturday, said it had replaced 90 per cent of the amount stolen by using company money to buy new tokens. The remaining 10 per cent consists of less liquid tokens, which may take longer to buy. The company said on X that it would continue buying the remaining relevant token assets until the covered amount reached 100 per cent for all tokens, adding that Binance would absorb the financial impact of the stolen funds rather than its users.
The money spent re-buying tokens came from a $1bn Secure Asset Fund for Users, a Bitcoin reserve Binance holds to protect customers in the event of security breaches, as well as some of its Futures Insurance Fund and its corporate treasury. Crypto prices fell on Friday as Binance, which runs the world's largest crypto exchange, sought to reassure customers their funds were safe. Co-CEO Richard Teng said on Friday that the breach was a complex attack involving a compromised laptop and malicious software designed to delete evidence of its activity, making it hard to trace and investigate.
After the hack, the exchange stopped allowing customers to withdraw their funds. Binance said later on Saturday that it was on track to reopen withdrawals on Sunday, and announced the publication of a new proof-of-reserves snapshot, allowing users to independently verify that their assets were backed at a minimum 1:1 ratio.
What is not yet known is how the breach was carried out in detail, how much of the stolen Ethereum has already moved beyond tracing, and whether the FBI's attribution will be followed by sanctions or other measures. The report does not say whether any arrests have been made. For the wider market, the episode turns on two questions: whether Binance's reserve funds can absorb losses of this scale without strain, and whether exchanges will act on the FBI's list of addresses quickly enough to slow the laundering.
