FBI Blames North Korea for Multi-Billion Dollar Binance Theft

The FBI has attributed the theft of more than $6bn from cryptocurrency exchange Binance to North Korea. In a brief statement published on October 31, the Bureau named the TraderTraitor group (also known as Jade Sleet, UNC4899 and Slow Pisces). It said it is working with the US Secret Service and IRS Criminal Investigation, and has seen the attackers converting stolen assets mainly into Ethereum. The FBI expects the funds to be laundered further through decentralised finance products and instant swap services. It urged crypto businesses to block transactions linked to addresses the group is using.

Blockchain analytics company Elliptic says around $2.9bn of the stolen funds have been frozen or seized. That still leaves roughly $3.25bn that cannot be frozen by an issuer, spread across more than 800 addresses. Elliptic also reported that the attack involved more than one individual and used a self-destruct mechanism that wiped tooling and traces as it ran, making forensic analysis harder.

Binance has said it will cover the costs, so customer funds are not in danger. It is still investigating the cause. The company first suggested a compromised DevOps laptop may have been the source, but later said it had uncovered additional points of breach in what it calls a complex attack.