Skip to main content
eCrypto

Crypto markets, protocols and policy

FBI blames North Korea for record Binance crypto theft

The FBI says North Korea stole more than $6 billion from Binance; the exchange says users will not bear the loss as it works to recover assets.

eCrypto Editorial3 min read

FBI blames North Korea for record Binance crypto theft

The FBI has attributed the theft of more than $6 billion from Binance to North Korean hackers, naming the operation TraderTraitor. The bureau said the theft happened on or about October 29, and Reuters reported the loss at $6.3 billion, making it a record crypto theft.

The FBI’s announcement makes a formal attribution that was not established in Binance’s first public update. The exchange said its investigation was ongoing and had not identified who was responsible.

What did the attackers take from Binance?

Binance said attackers made unauthorized withdrawals from its hot wallets at about 20:05 UTC on October 29. Hot wallets are connected to systems used to move funds, so the breach affected assets held for transactions.

Reuters reported that the bulk of the theft happened over about 20 minutes. The transactions drew on multiple cryptocurrencies, and blockchain analysts tracked the movement of funds after they left the exchange’s wallets.

The FBI said the attackers were converting the stolen assets primarily into Ether. It said they were expected to move the funds through decentralized finance services and instant swap services as part of further laundering.

How did the breach happen?

Binance’s initial investigation suggested a compromised engineer’s laptop may have given an attacker access to a service container, enabling unauthorized withdrawals. The exchange later said investigators had found additional points of breach.

In its October 30 security update, Binance said it had found no evidence that wallet private keys were leaked. It said the investigation was continuing, so the full sequence of the attack had not been confirmed.

That distinction matters because the exchange’s early account did not describe a confirmed theft of wallet keys. Reuters cited blockchain analysis that pointed instead to a compromise of Binance’s transaction-signing infrastructure, which authorizes transfers. That analysis offers a possible explanation, but Binance had not published a complete technical report.

Who is covering the loss, and what can be recovered?

Binance said it would absorb the financial impact through its Secure Asset Fund for Users and corporate funds. In its October 30 update, the company said it had set aside more than $6.34 billion, including $5 billion in the same types of assets that were stolen.

Binance also said it had worked with law enforcement, blockchain investigators, asset issuers and industry partners to freeze about $3 billion on-chain. Some stablecoin issuers can freeze tokens in their systems, limiting the ability to move those funds. Bitcoin and Ether do not have a central issuer that can freeze them.

The FBI said it had identified wallet addresses linked to the TraderTraitor actors and urged crypto services and other industry firms to block transactions connected to those addresses. Its alert names North Korea as responsible for the theft; Binance’s public update described its own investigation as ongoing.

The exchange said customers would not bear the loss. The amount frozen or recovered may change as tracing continues, and Binance has said it is still working with authorities and industry partners.

References