FBI blames North Korea for stolen billions from Binance in biggest hack in history

The Binance attack moved billions of dollars in cryptocurrency within minutes. The FBI linked it to TraderTraitor, an entity it describes as responsible for malicious cyber activity. The link matters because the group was also connected to the US$1.5 billion Bybit hack last year, suggesting a repeated and highly capable operation.

The FBI said its investigation found TraderTraitor was converting the stolen assets mainly into ethereum. It asked exchanges, blockchain analytics companies, and others to block transactions connected to listed addresses. Blocking those movements could help prevent laundering and preserve a path to recovery.

The FBI expects the hackers to keep converting the assets through DeFi and instant-swap services. President Donald Trump said investigators were not yet certain North Korea was involved, though he acknowledged that conclusion could still be reached. The FBI's public attribution remains the central explanation in the report.

The theft totaled US$6.3 billion in bitcoin and other digital currency. The article describes it as the biggest cryptocurrency heist in history, a scale that immediately raised questions about both Binance’s security and North Korea’s ability to obtain illicit revenue.

Binance said on Saturday that it had set aside enough of the same digital currency that was stolen to cover 90 per cent of the missing assets. It also promised that customers would be fully reimbursed. That statement separates the company’s ability to repay customers from the harder task of tracking and recovering the stolen funds.

The remaining assets still create a major investigative challenge. The FBI asked exchanges and blockchain analytics companies to block transactions linked to various addresses. It expects the hackers to use DeFi and instant-swap services, while experts say the money may be divided among smaller exchanges over months.

A cryptocurrency exchange is a digital marketplace that lets users buy, sell, and trade cryptocurrencies. Exchanges connect buyers and sellers and hold or transfer assets during those transactions. Their central role makes them important parts of the cryptocurrency system and places them in direct contact with large volumes of money.

The Binance case shows why that concentration matters. The company is described as the world’s largest crypto exchange, yet US$6.3 billion in bitcoin and other digital currency was stolen in minutes. A successful attack can therefore produce enormous losses before investigators or companies have time to respond.

The consequences extend beyond the exchange itself. Binance promised customers full reimbursement and said it could cover 90 per cent of the missing assets. Meanwhile, the FBI asked exchanges and analytics companies to block linked transactions. Their cooperation can limit movement and help investigators trace the funds after the theft.

DeFi platforms and instant-swap services can provide ways to convert cryptocurrency without using the original exchange. Smaller exchanges may offer additional routes. If stolen assets pass through several services, their path can become more complicated, potentially helping criminals obscure the money’s origin and evade detection.

The FBI expects TraderTraitor to use DeFi and instant swaps. Ari Redbord said the hackers would probably break the assets into pieces and launder them through smaller exchanges. He said this process could unfold over months, rather than ending with one large transfer that investigators can easily identify.

That movement does not make the money invisible. Redbord said blockchain investigators can track and trace funds in real time, build investigations, disrupt transfers, and seize funds back. The FBI also asked exchanges and analytics companies to block transactions tied to various addresses, creating barriers to laundering.

Recovery does not depend on one method. Investigators and companies can follow the stolen assets on blockchain records, identify destinations, and coordinate with exchanges or analytics firms. They can also ask services to block transactions associated with suspicious addresses before the funds move farther.

The FBI took that approach after the Binance theft. It asked cryptocurrency exchanges, blockchain analytics companies, and others to block transactions linked to various addresses. Ari Redbord said investigators can track funds in real time, build cases, disrupt laundering, and seize funds back. These steps attack both the movement and the concealment of the money.

The exchange itself can absorb some of the damage. Binance said it had enough of the same digital currency to cover 90 per cent of the missing assets and promised customers full reimbursement. Recovery remains difficult because hackers may split the assets and move them through smaller exchanges over months.

The article presents cybercrime as one possible way for North Korea to capture revenue outside normal international financial channels. It says the country faces extensive international sanctions over its nuclear and missile programs. Those sanctions restrict lawful economic activity and help explain why investigators are focused on illicit methods of raising money.

TraderTraitor illustrates the alleged approach. The FBI linked the entity to the Binance theft and to last year’s US$1.5 billion Bybit hack. The group was converting stolen assets mainly into ethereum, then was expected to use DeFi and instant-swap services. Such activity can turn a cyberattack into money that is harder to connect to its original source.

The scale of the Binance theft has therefore put a spotlight on North Korea’s capabilities. The FBI says the actors are North Korean hackers, but President Donald Trump said investigators were not yet certain. The attribution may be refined as funds are traced and the investigation develops.

A blockchain records cryptocurrency transactions as digital movements between addresses. Because those records remain available for analysis, investigators can follow where funds go after a theft. This does not automatically reveal a person’s identity, but it can show the money’s route and connect separate transfers.

The Binance investigation demonstrates the method. The FBI identified addresses linked to the stolen assets and asked exchanges and analytics companies to block transactions involving them. It also found that TraderTraitor was converting the assets mainly into ethereum. Each conversion or transfer can provide another point for investigators to examine.

Criminals may still try to complicate that trail. Ari Redbord expects the hackers to break the money into pieces and use smaller exchanges, DeFi, and instant-swap services. Yet he said funds can be tracked and traced in real time, helping investigators build cases, disrupt laundering, and potentially seize assets.