The US Federal Bureau of Investigation announced on October 31 that hackers associated with North Korea had stolen virtual assets from the world’s largest cryptocurrency exchange on or around October 29. The agency identified the operation as TraderTraitor, a hacking campaign previously linked to cryptocurrency thefts attributed to Pyongyang.
The announcement followed an assessment by blockchain intelligence company TRM Labs, which attributed an estimated $6.36 billion theft involving Binance to the same North Korean operation. The FBI independently confirmed responsibility but described the stolen amount as exceeding $6 billion without specifying a precise figure.
US investigators are now concentrating on tracing the stolen cryptocurrency and preventing its conversion into assets that would be harder to recover. The FBI said it was coordinating with the US Secret Service and the Internal Revenue Service’s Criminal Investigation division to identify suspicious transactions and disrupt laundering activities.
The agencies have observed the hackers converting stolen digital assets primarily into Ethereum, one of the largest cryptocurrencies by market capitalisation. Investigators expect further transfers through decentralised finance platforms and instant exchange services, which can facilitate conversions between different cryptocurrencies.
The FBI issued an alert urging cryptocurrency businesses, blockchain infrastructure operators and financial intelligence companies to block transactions involving digital wallet addresses associated with the operation. The warning identified addresses believed to hold stolen funds or to have previously handled assets connected to the theft.
The advisory specifically addressed THORNode operators, remote procedure call node operators, instant exchanges, decentralised finance services, blockchain analytics companies and other virtual asset service providers. Their cooperation could help investigators identify transfers before stolen cryptocurrency moves through additional intermediaries.
The scale of the theft places the incident among the most significant cryptocurrency security breaches disclosed by US authorities. The amount attributed to the attackers substantially exceeds losses associated with several earlier high-profile attacks on digital asset platforms.
Binance acknowledged that its hot wallets were compromised at approximately 20:05 GMT on October 29, resulting in unauthorised withdrawals valued at roughly $6.3 billion. The exchange said it had contained the affected infrastructure, revoked compromised authorisations and strengthened security controls.
The company pledged to absorb the losses rather than pass them to customers. It committed more than $6.34 billion from corporate resources and its Secure Asset Fund for Users to replace affected cryptocurrency holdings.
By October 31, Binance said it had replenished approximately $6 billion of the stolen assets. The remaining shortfall involved less liquid tokens that could take longer to acquire. The exchange also said approximately $3 billion in affected assets had been identified for freezing or recovery efforts.
Binance temporarily suspended withdrawals while engineers examined the breach and upgraded security systems. Deposits and unaffected services continued operating. The company said withdrawals would resume gradually after the necessary security checks, although restoration remained subject to technical assessments.
The exchange’s preliminary investigation initially suggested that a compromised employee laptop might have enabled unauthorised access. Subsequent examinations identified additional points of intrusion, prompting a broader investigation into the methods used by the attackers.
Binance said investigators had found no evidence that wallet private keys had been leaked. That distinction is significant because the attackers may have exploited weaknesses in transaction authorisation systems rather than obtaining the cryptographic credentials directly controlling the wallets.
TRM Labs traced suspicious transfers across ten blockchain networks, including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger. Its analysis indicated that substantial withdrawals occurred within approximately 20 minutes, suggesting coordinated execution across multiple cryptocurrency systems.
The company identified approximately $3.79 billion in Ethereum-based assets among the stolen funds, alongside Bitcoin holdings valued at approximately $1.47 billion. Additional losses involved stablecoins and other digital tokens distributed across several networks.
TRM Labs assessed that the attackers had prepared parts of the operation before executing the transfers. Its findings indicated that the compromised infrastructure enabled transactions across multiple blockchain networks during a tightly coordinated sequence.
The FBI’s public advisory listed cryptocurrency addresses associated with the suspected hackers, allowing exchanges and transaction monitoring companies to screen transfers against identified wallets.
Binance also announced plans to publish updated proof-of-reserves information showing the assets backing customer balances, with an initial report scheduled for November 2. The exchange said a detailed technical examination would follow once investigators had established the sequence of the breach.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
