WASHINGTON, November 1 (Aalimi Nation) – The Federal Bureau of Investigation has attributed the record theft of about $6.3 billion in digital assets from the Binance cryptocurrency exchange to North Korean hackers, saying the stolen funds are being converted into Ether and are expected to be laundered further.
In a statement issued on Saturday with the US Secret Service and the IRS Criminal Investigation unit, the FBI said North Korean actors were behind the theft, which was carried out on Thursday. It linked the operation to a group known as TraderTraitor, which it also blamed for the theft of $1.5 billion from the Bybit platform in February last year.
The agency said the group was mainly converting the stolen assets into Ether and that it expected the funds to be "further laundered" in stages through decentralised finance tools and instant swap services. It asked private-sector firms, including node operators, instant exchanges and other virtual asset service providers, to block transactions linked to the addresses it published. The list included more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address.
The exchange has estimated the loss at $6.3 billion. A blockchain analytics firm, Chainalysis, has put the figure at roughly $6.4 billion, so the amount differs slightly between estimates. It is described as the largest crypto theft on record.
Binance said in a statement on Saturday that it had replaced 90 per cent of the stolen amount from company money by purchasing new tokens, while the remaining 10 per cent sits in less liquid tokens that may take longer to buy. "Binance will absorb the financial impact of these stolen funds, not our users," the company said in a post on X.
The exchange said the money came from its $1 billion Secure Asset Fund for Users, a reserve set up to protect customers after security breaches, along with part of its futures insurance fund and its corporate treasury. Co-chief executive Richard Teng said on Friday that the breach was a "complex attack" involving a compromised laptop and malicious software designed to delete evidence of its activity.
Binance halted customer withdrawals after the incident, and said it was on track to reopen them on Sunday. It also published a new proof-of-reserves snapshot that lets users verify that their assets are backed at least one-to-one.
Chainalysis said the attackers had already used "thousands of addresses" and that it expected the number to grow into "tens of thousands over the coming weeks", according to its chief executive, Jonathan Levin. He described the attackers as using "novel automated laundering mechanisms" to obscure the trail of funds.
It has also been reported that issuers of stablecoins, which are digital tokens pegged to currencies, have frozen more than $2.4 billion of the stolen funds. However, laundering of the remaining amount is said to be continuing.
Asked about the matter on Saturday, US President Donald Trump said "we're learning about it" and that his administration would "talk to North Korea about it". There was no immediate response from Pyongyang in the information reviewed for this report.
