(LEAD) Trump says U.S. will talk to N. Korea if it is behind Binance hack

The FBI is investigating the theft of more than US$6 billion from Binance, reported to have occurred on or about Oct. 29. The agency says North Korea was responsible. The case matters because the stolen cryptocurrency could help fund further cyber activity if it is successfully laundered.

The FBI identified the suspected operation as TraderTraitor. That name has previously been associated with cryptocurrency thefts carried out by North Korean hackers. The agency also observed the hackers converting the stolen assets, mainly into Ethereum. Blockchain intelligence firm TRM Labs separately attributed the estimated $6.36 billion theft to TraderTraitor.

The attribution is still described through an FBI alert and an earlier TRM Labs assessment, rather than a reported criminal conviction. Investigators expect the hackers to move the assets through decentralized finance platforms and exchanges. U.S. agencies have urged companies to block transactions involving wallets connected with the suspected laundering activity.

Binance is a cryptocurrency exchange, meaning a platform where users can trade and transfer digital assets. The article identifies it as the world’s largest cryptocurrency exchange. A theft from such a prominent platform matters because it affects a major concentration of cryptocurrency activity and creates a large pool of stolen funds to track.

The reported incident involved more than US$6 billion. The FBI said hackers converted the stolen assets primarily into Ethereum, a major cryptocurrency. That conversion can make the money harder to follow across different services, while preserving a digital record of transfers for investigators and blockchain analysts.

The immediate concern is not only the initial loss. The FBI expects the hackers to launder the assets through decentralized finance platforms and exchanges that quickly swap one digital asset for another. U.S. agencies therefore urged exchanges and other providers to block transactions involving the identified wallet addresses.

The article reports two figures: more than US$6 billion and an estimated $6.36 billion. That would make this one of the largest reported cryptocurrency thefts ever described. Its size matters because recovering, freezing, and monitoring such a large amount can strain exchanges, investigators, and blockchain-analysis teams.

For scale, established estimates put the 2014 Mt. Gox theft near $450 million, the 2018 Coincheck hack near $530 million, and the 2022 Ronin Network hack near $625 million. Those comparisons use outside reporting and estimates, not figures provided in this article. The Binance figure would be many times larger than each.

The amount remains a reported estimate, not a final court-established loss in the supplied text. The FBI says the assets were being converted and may be laundered through DeFi platforms and exchanges. That creates a continuing race between tracing the funds and rapidly swapping them.

TraderTraitor is a label for a North Korean cyber operation linked to cryptocurrency thefts. The FBI used the name in its cyber alert after saying North Korea was responsible for the Binance incident. Identifying the suspected actor matters because it can guide financial restrictions, defensive warnings, and diplomatic responses.

The FBI pointed to the operation’s established association with cryptocurrency thefts by North Korean hackers. It also reported observing the hackers convert stolen assets primarily into Ethereum. Separately, blockchain intelligence firm TRM Labs attributed the estimated $6.36 billion theft to TraderTraitor. These are the article’s stated attribution indicators.

The supplied report does not describe the technical evidence in detail, such as malware code or server records. It therefore presents an agency finding and an independent company assessment, not a full public forensic case. Investigators are still tracking the funds, while the FBI warns that further laundering through DeFi platforms and exchanges is expected.

When hackers convert stolen cryptocurrency into Ethereum, they change the digital asset in which the funds are held. Moving through decentralized finance platforms and exchanges can then split, combine, or rapidly swap the funds. This matters because each additional service and asset change can complicate efforts to identify the final destination.

The FBI said the hackers were converting the assets primarily into Ethereum. It also warned that they were expected to launder the funds through DeFi platforms and exchanges that let users quickly swap one digital asset for another. Those services can provide speed and layers of transactions, although they do not automatically erase transaction histories.

The practical consequence is a race to identify and block the relevant wallet addresses before the funds move again. The FBI, Secret Service, and IRS Criminal Investigation division were cooperating on the case. They urged virtual-asset providers to block transactions involving addresses used to launder the stolen money.

Cryptocurrency exchanges, blockchain operators, analytics firms, and other virtual-asset providers can use identified wallet addresses to screen incoming and outgoing transactions. If a transfer matches a flagged address, a provider may block it, hold it for review, or report it to investigators, subject to applicable rules and procedures.

The FBI, U.S. Secret Service, and IRS Criminal Investigation division were cooperating on the case. They urged providers to block transactions involving wallet addresses used by the North Korean hackers to launder the stolen funds. Blockchain analytics firms can also follow transfers as the assets move between wallets, exchanges, and DeFi services.

Governments can support this work by sharing alerts, coordinating agencies, and warning companies about suspected laundering routes. The FBI specifically warned that the hackers might use services allowing fast swaps between digital assets. Speed matters because blocking a transaction before another swap may be easier than recovering funds later.

A blockchain is a shared digital ledger that records cryptocurrency transactions. A digital wallet is represented by an address used to receive or send assets. The ledger generally records the addresses, amounts, and transaction times, while the real-world identity behind an address may not be immediately visible.

When stolen funds move from one wallet to another, those transfers create additional entries. Converting assets into Ethereum or routing them through exchanges and DeFi platforms can make the trail more complicated, but it does not automatically remove the earlier records. Investigators and analytics firms can examine the sequence of transfers and identify related wallet activity.

The article shows this process in practice. The FBI observed the stolen assets being converted primarily into Ethereum and urged providers to block identified wallet addresses. Records can therefore support tracing and intervention, even when criminals try to obscure the destination. Linking an address to a person or organization may require information beyond the ledger.