The FBI has formally attributed the $6.3 billion theft from Binance to a North Korean state-sponsored hacking group known as TraderTraitor, marking the largest cryptocurrency heist in history. The agency stated it had observed the group converting stolen assets into Ethereum and expected further laundering efforts.
Binance initially reported the breach on October 29, describing unauthorized withdrawals and freezing $3 billion in assets during its investigation. The exchange later identified multiple intrusion points but found no evidence that wallet private keys had been compromised. The FBI’s attribution came days after the incident, aligning with previous allegations linking North Korea to similar attacks.
North Korea has categorically denied the accusations, with Kim Yo-jong, sister of leader Kim Jong Un, calling the FBI’s claims a “grave political provocation” in a statement carried by state media. She accused Washington of attempting to brand North Korea as a “cyber criminal state” and warned of “issues to reconsider” regarding U.S. hostility. The denial follows a pattern of Pyongyang rejecting cybercrime allegations tied to cryptocurrency thefts.
Blockchain analytics firms Elliptic and Chainalysis have traced the stolen funds across multiple blockchains, documenting 40,000 transactions involving 12,000 wallets in the first four days post-attack. The hackers used decentralized exchanges to swap stablecoins into untraceable cryptocurrencies, with $786 million in stablecoins converted before issuers like Tether and Circle froze remaining assets. Much of the laundering occurred on the Tron blockchain, where funds were distributed before moving to Ethereum via cross-chain bridges.
FBI Response
The FBI has urged industry partners to block transactions linked to TraderTraitor, emphasizing its commitment to disrupting North Korea’s illicit cyber activities. The bureau’s statement did not provide additional details on the evidence linking the group to the hack, though it referenced prior attributions to the same unit for other cryptocurrency thefts.
North Korean Denial
Kim Yo-jong framed the FBI’s allegations as part of a long-standing U.S. strategy to undermine North Korea’s international standing. She cited the Trump administration’s plans to confiscate illicit cryptocurrency as evidence of Washington’s broader hostility, suggesting the true beneficiaries of the hack could reveal the perpetrators. North Korea has consistently denied involvement in cybercrimes, including the $1.5 billion Bybit hack in 2023, which the FBI also attributed to TraderTraitor.
Blockchain Forensics
Security researchers note that North Korean hackers have refined their laundering techniques, using automated tools to obscure fund trails. The average of one new wallet every 25 seconds during the initial laundering phase underscores the sophistication of the operation. Analysts warn that the stolen assets could fund North Korea’s weapons programs or evade international sanctions, given the country’s reliance on illicit revenue streams.
Binance has not commented on the FBI’s attribution but confirmed it is cooperating with authorities. The exchange resumed withdrawals after suspending them briefly, though the full extent of the breach remains under investigation.