FBI attributes $6bn Binance theft to North Korea

Did North Korea steal billions from Binance? The FBI says yes: in an October 31 notice, it attributed more than $6 billion in assets stolen around October 29 to North Korea and named the activity “TraderTraitor.” The agency’s alert on the Binance theft makes the laundering trail the immediate focus of the investigation.

Where are the stolen assets moving?

The FBI says it has observed TraderTraitor converting the stolen assets primarily into Ethereum. The bureau, alongside the US Secret Service and IRS-CI, expects the actors to move funds through decentralized finance services and instant swap services as they prepare them for further laundering. It urged node operators, exchanges, DeFi services, analytics firms and other virtual asset providers to block transactions linked to addresses in its alert.

What does Binance say happened?

Binance’s preliminary investigation pointed to a compromised DevOps engineer’s laptop, which may have let an attacker access a service container and submit unauthorized withdrawal transactions, the Associated Press reported. Binance said it had found no evidence that wallet private keys were leaked, and that roughly $3 billion in affected assets had been frozen on-chain. The AP also reported that Binance said on Saturday it had enough of the same digital currency set aside to cover 90% of the missing assets and would fully reimburse customers.

What should you watch next?

The key measure is how much of the stolen value can still be blocked as it moves between wallets and services. The FBI published addresses holding or previously holding assets linked to TraderTraitor, giving private firms specific transactions to screen. Watch for updates to those addresses and the next reported figure for funds frozen or recovered.

References

• alert on the Binance theft — fbi.gov
• Associated Press reported — apnews.com