FBI Blames North Korea's Lazarus Group for Record $6.3 Billion Binance Theft

The FBI has blamed North Korean hackers for the record $6.3 billion theft from cryptocurrency exchange Binance. In an alert published Saturday, the agency attributed the October 29 attack to TraderTraitor, a North Korean operation linked to the Lazarus Group. Blockchain intelligence firms TRM Labs and Elliptic had already linked the theft to North Korea. TRM reported that most of the haul disappeared in about 20 minutes, while Elliptic says it has verified that $2.85 billion of the stolen assets have been frozen or seized.

According to Binance, the incident started with a compromised DevOps engineer's laptop. That gave the intruders access to a service container and let them authorize withdrawals they should never have been able to make. The FBI says the hackers have begun swapping the loot for Ethereum and are expected to use decentralized finance platforms and instant swap services to make the money harder to trace. The agency has published a list of linked wallet addresses and is urging exchanges and other virtual asset providers to block related transactions.

Binance has resumed customer withdrawals and says it has replenished about 95 percent of the stolen assets, with the rest harder to replace because of limited liquidity. Co-CEO Richard Teng has promised customers will not bear the loss. Even so, Binance recorded roughly $3.64 billion in net outflows after withdrawals resumed, which the company says is about 2.1 percent of its reported assets.