A hacker types on a computer keyboard on May 13, 2025, in this photo illustration. Oleksii Pydsosonnii/The Epoch Times
The FBI on Oct. 31 blamed the North Korean regime for the hack of $6.3 billion in digital currencies from cryptocurrency exchange Binance just days earlier.
The bureau said it was releasing information on the “malicious cyber activity” after observing a North Korean actor identified as “TraderTraitor” converting the stolen assets into other cryptocurrencies.
Most of those conversions went into the cryptocurrency ethereum, the FBI said, adding that it expects “further laundering” of the assets through the use of related technology.
It urged virtual asset service providers in the private sector to assist in thwarting the criminal group’s expected attempts to launder the stolen assets by blocking the transactions linked to known TraderTraitor actors. The FBI provided a list of addresses associated with TraderTraitor activity.
TraderTraitor is known to the FBI. It was behind a $1.5 billion Bybit hack last year.
The FBI’s statement was issued after private blockchain analysis companies TRM Labs and Chainalysis, on the day of the Oct. 29 hack, blamed the heist on North Korean state actors. TRM Labs said the assets were moved in about 20 minutes.
The $6.3 billion theft from the world’s largest crypto exchange was the biggest crypto heist in history.
Binance said on Oct. 29 that along with its service providers, it was able to freeze about $3 billion in affected assets on-chain—largely stablecoins that issuers can blacklist—after detecting the breach.
In an announcement on Oct. 31, Binance co-CEO Richard Teng promised that all customers would be fully reimbursed. He said the company had reassigned tokens it has on hand and funds to cover 90 percent of the value of the stolen assets—which included Bitcoin and other digital currencies.
Teng said the remaining 10 percent are tokens that may take longer to buy back because they are less liquid.
The company said on Oct. 31 on X that the funds come from its $1 billion bitcoin reserve held in its “Secure Asset Fund for Users” assigned to protect customers in the event of security breaches, which will go toward covering the outstanding 10 percent of tokens, as well as from its Futures Insurance Fund and corporate treasury.
The company added that it is committed to “replenishing the SAFU to return the fund size to approximately US$1 billion.”
Teng said earlier on Oct. 30 that the breach was a “complex attack” involving an engineer’s compromised laptop and malicious software designed to delete evidence of its activity, making it harder to trace and investigate.
After the hack, the exchange stopped allowing customers to withdraw their funds, but it said on Oct. 31 it was still on track to reopen withdrawals on Nov. 1.
Binance was co-founded in 2017 by Chinese Canadian Changpeng Zhao and Chinese national Yi He in China. In 2023, Zhao pleaded guilty in the United States to failing to maintain an effective anti-money-laundering program at the exchange.
He resigned and served a four-month prison sentence for violating the Bank Secrecy Act and anti-money-laundering laws. He was released from prison in 2024 and received a pardon from President Donald Trump last year.
As of Oct. 31, the global market capitalization for cryptocurrencies is about $2.6 trillion. The four biggest crypto market caps are Bitcoin’s $1.56 trillion, Ethereum’s $276 billion, Tether’s $180 billion, and Binance coin’s $92 billion. The main Binance coin is called the BNB.
Crypto prices fell on Oct. 30 upon news of the hack.
Ryan Morgan, Aldgra Fredly, Reuters, and The Associated Press contributed to this report.
