It’s official – for what it’s worth: North Korea “was responsible for the theft of more than $6 billion USD in virtual assets” from Binance on Thursday, according to a Saturday FBI cyber alert. The agency says says Kim Jong Un’s ‘TraderTraitor’ hacking operation was responsible.
As we reported Thursday, TRM Labs and Chainalysis blamed N. Korea within a day, while Tether and Circle froze billions in stolen stablecoins. TRM puts the haul at $6.36 billion and calls it the largest hack in history; Chainalysis said its investigators concluded that the Binance loot was “commingling” with funds North Korea from last month’s Bitget exploit.
Working in conjunction with US Secret Service and IRS Criminal Investigation, the FBI says it has “observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH),” and that “it is expected these assets will then be further laundered by converting them using DeFi and instant swap services.” It published 628 addresses it says “are holding or have held assets from the theft” – 608 on Ethereum, 19 on Bitcoin and one on Solana.
The agencies are urging “THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from” those addresses. The list may already be falling behind: Chainalysis CEO Jonathan Levin told CoinDesk the attackers have used “thousands of addresses,” adding, “We anticipate this will become tens of thousands over the coming weeks.”
Binance, meanwhile, insists its customers won’t eat the loss. As we reported last night, the exchange said it had replaced 90% of the roughly $6.3 billion with its own funds, and on Sunday it began reopening withdrawals in phases, starting with the Bitcoin network. Co-CEO Richard Teng put the replenished share at about 95% on Sunday, according to crypto.news.
