FBI links $6 billion Binance theft to North Korea

The FBI said on Oct. 31 that North Korea was responsible for stealing more than $6 billion in virtual assets from Binance around Oct. 29, identifying the activity as TraderTraitor. The bureau said the attackers were converting the assets mainly into ether, and urged crypto firms to block transactions linked to laundering addresses, according to the FBI’s alert.

How much was stolen, and when?

The theft took place on Thursday, Oct. 29, according to the Associated Press, which reported that $6.3 billion in bitcoin and other digital currency was taken from Binance. The FBI’s notice describes the stolen amount as more than $6 billion and dates the theft to “on or about” Oct. 29.

The AP reported that Binance said it had enough of the stolen cryptocurrencies set aside to cover 90% of the missing assets and promised customers full reimbursement. The FBI’s attribution names TraderTraitor, a label the bureau uses for this North Korean cyber activity.

How does the FBI say the funds are moving?

The FBI said it and its partners at the U.S. Secret Service and IRS Criminal Investigation observed the attackers converting the stolen assets primarily into ether. It expects the group to move funds through decentralized finance and instant swap services as part of further laundering.

The bureau published cryptocurrency addresses it said were holding, or had held, assets from the theft. The Associated Press report said the FBI asked exchanges and blockchain analytics firms to block linked transactions to hinder laundering.

What happens next?

The FBI, Secret Service and IRS-CI are asking node operators, exchanges, DeFi services and other virtual-asset businesses to block transactions involving the listed addresses or funds derived from them. The FBI expects laundering attempts to continue through DeFi and instant swap services; its alert gives no deadline for the industry response.

References

• FBI’s alert — fbi.gov
• Associated Press report — apnews.com