FBI Blames North Korea for the Binance Heist
The agency points to the TraderTraitor group, published 628 crypto addresses and asked platforms to block their transactions.
North Korea is responsible for the theft of more than $6 billion in cryptocurrency from Binance, the FBI says. A cybersecurity alert issued Saturday, Oct. 31, puts the heist "on or about" Oct. 29 and names TraderTraitor, the North Korean group also known as Lazarus Group, Jade Sleet and APT38.
The alert lists 628 wallet addresses tied to the theft. Nearly all are on Ethereum (608), with 19 on Bitcoin and one on Solana. Together with the Secret Service and the criminal investigation arm of the IRS, the U.S. tax agency, the FBI asked exchanges and network operators to block any movement linked to those addresses.
For anyone who trades crypto, that means a platform can freeze or reject a transfer that touches one of the addresses. Legitimate payments that pass through them could be delayed.
The group mostly converts what it steals into Ether. To launder it, the FBI says, the hackers will keep using decentralized finance (DeFi) platforms and instant-swap services.
The total is not exact. The FBI says "more than $6 billion." TRM Labs, a blockchain analytics firm, put it at about $6.36 billion pulled from Binance wallets across ten networks, most of it in roughly 20 minutes, and calls it the largest hack ever. The FBI figure works as a floor.
Binance says its users will not bear the loss. CEO Richard Teng said the company "will absorb the financial impact." On how the attackers got in, Binance first pointed to an engineer's compromised laptop, then acknowledged "additional points of intrusion." Both accounts come from the company and have not been independently verified. No technical cause is confirmed.
Binance began reopening withdrawals in phases on Nov. 1. The company says it has restored about 95% of the affected funds after the $6.3 billion theft it disclosed in late October.
