FBI Attributes More Than $6 Billion Binance Theft to North Korea
Key Facts
On October 31, the US Federal Bureau of Investigation attributed the theft of more than $6 billion from Binance to North Korea, saying the attack occurred around October 29 and naming the associated cyber activity TraderTraitor. The incident is a blow to the world’s largest cryptocurrency exchange, as US authorities and analytics firms pursue two parallel tracks: tracing the stolen assets and compensating those affected. The FBI said the attackers converted the assets mainly into ether and that it expects them to use decentralized finance services and instant exchanges in later stages of money laundering. North Korea denied involvement on Tuesday, describing the US announcement as a "crude provocation." The allegations come amid Pyongyang’s denial, while Binance said its subsequent investigation uncovered additional breach points and found no evidence that private wallet keys had been leaked.
TRM estimated that the attacker redirected a Binance hot wallet to a collection contract it controlled, using authorizations on the Ethereum network. The firm said one transaction included 50 pre-signed authorizations, and suggested the mechanism pointed to access to the hot wallets’ transaction-signing system. Earlier, Binance said its initial investigation indicated a compromised laptop may have been involved, but its account expanded after the subsequent investigation found additional breach points. The platform said it found no evidence that private wallet keys had been leaked. In tracing the funds, Elliptic said the assets passed through decentralized exchanges, lending protocols and cross-chain bridges, using about 20 automated services in less than three days. The firm found no evidence that artificial intelligence made the transfer decisions.
Estimates of frozen funds varied among the parties; Binance said on October 30 that about $3 billion had been frozen on-chain as of that date. In an update on compensation, the platform said it had allocated more than $6.34 billion to cover losses, including $5 billion in the affected tokens themselves, and at the time estimated coverage at about 80% of the affected amount. It then said coverage had risen to about 95%, compared with about 90% in an earlier update, and that the remaining 5% involved tokens outside the largest ten assets it had listed. It added that the lower liquidity of those tokens was slowing the provision of the required amounts. The platform said it continued to buy the remaining assets through the market and over-the-counter channels.
The resumption of withdrawals tested customer confidence in the platform after the incident. According to Reuters estimates, Binance customers’ net withdrawals totaled $4.72 billion from the platform’s reopening through November 2, and the company said this figure was equivalent to about 3% of its assets. Reuters noted that Binance recorded net outflows of about $6 billion in the 72 hours after the collapse of FTX in 2022. Across the broader market, spot Bitcoin exchange-traded funds recorded outflows of $643 million on Friday, October 30, their largest daily withdrawals in October, while leveraged positions worth more than $1.3 billion were liquidated. Bitcoin fell 3.2% on Thursday evening to below $79,000, before recovering after hitting a six-week low on Friday to trade above $77,000 on Monday.
Binance announced a gradual resumption of withdrawals on November 1, with the first phase set to begin between 06:00 and 09:00 UTC, as services were restored after security and readiness checks. This followed the company’s announcement that it had allocated funds to cover losses and continued to provide the remaining assets. The on-chain freeze announced by Binance remains a separate measure from the amounts the platform has made available again to its customers. The company said it would publish a post-incident report with further details once the investigation was complete. The outcome of the technical investigation and details of the additional breach points remain among the information the platform has pledged to publish later.