TL;DR · 30-second read

The Short Version

Thieves took about $6.3 billion in digital currency from Binance, the world’s biggest digital-currency trading platform, in a matter of minutes. It is the largest theft of its kind ever recorded.

American federal investigators say a North Korean hacking group did it. They say it is the same group that stole $1.5 billion from another trading platform last year.

The stolen money is now on the move. Getting it back depends on other trading services refusing to handle it. Binance says customers will be repaid in full.

The FBI said Saturday that North Korean hackers carried out this week’s theft of $6.3 billion in bitcoin and other digital currency from Binance, the world’s largest cryptocurrency exchange, the Associated Press reported. The bureau linked the attack to an entity known as TraderTraitor, the same actors it holds responsible for a $1.5 billion hack of the exchange Bybit last year. The theft took place Thursday and was completed within a matter of minutes.

The FBI asked exchanges, blockchain analytics companies and others to block transactions linked to specific addresses. It said TraderTraitor was converting the stolen assets mainly into ethereum and expects the group to try to move them through decentralized finance (DeFi) and instant swap services. Binance said it had reserves in the same currencies that were stolen to cover 90% of the missing assets, and it promised that customers would be fully reimbursed.

Executive Summary

The largest cryptocurrency theft on record now has an official attribution. The FBI’s statement names a single, previously identified group behind both this attack and last year’s Bybit hack. That puts the two largest known exchange thefts in one operator’s column. In about a year, the haul from that group’s largest single attack has grown roughly fourfold, from $1.5 billion to $6.3 billion.

The more immediate operational point is where the incident goes next. Once stolen funds leave the victim’s wallets, Binance can no longer stop them. The FBI’s request to block flagged addresses is addressed to everyone else: other exchanges, analytics firms, and the swap services and DeFi protocols the bureau expects the funds to pass through. How much of the $6.3 billion is ever recovered will depend largely on how quickly and consistently those third parties act.

For operators of financial and cloud infrastructure more broadly, the incident is a scale marker. A state-linked team was able to drain billions in minutes from the industry’s largest platform. Exposure of that size belongs in threat models and in reserve planning, and is no longer a tail risk to note and set aside.

Same Group, Roughly Four Times the Haul

The FBI’s attribution matters because of the pattern it creates. TraderTraitor was already tied to the $1.5 billion Bybit theft. Adding the $6.3 billion Binance theft means the same actors are behind the two largest exchange thefts on record, and their largest single take has grown roughly 4.2 times in about a year. One data point does not make a trend. Still, it is evidence that a well-resourced attacker is targeting the largest pools of value and succeeding against the biggest operator in the market.

Speed is the second notable figure. The theft was completed within a matter of minutes. TRM Labs’ Ari Redbord called it “bank robbery, in this case, at the speed of the Internet.” For anyone running high-value systems, whether an exchange, a payments processor or a cloud environment that holds signing keys or privileged credentials, that compresses the window for detection and response almost to zero. Defenses that depend on a human noticing an anomaly and intervening are of limited use when the loss is complete before a shift lead can be paged.

Binance has not publicly described how the attackers got in, and the attribution statement does not say either. That leaves other operators unable to check their own environments against a specific technique. The scale lesson applies anyway, even before the technical lesson is known.

After Attribution, Containment Moves Downstream

The FBI’s request shows who now holds the cards. The bureau asked exchanges, blockchain analytics companies and others to block transactions tied to the addresses it identified. A blockchain address works like an account number on a public ledger. Every transfer to and from it is visible, which is why investigators can follow the money. Visibility does not stop a transfer, though. Only a service that controls the next step can refuse to process it, such as an exchange that converts crypto to cash or a swap service that trades one token for another.

The FBI said TraderTraitor was converting the stolen assets primarily into ethereum, and it expects the group to move next through DeFi and “instant swap services.” DeFi refers to trading and lending software that runs on a blockchain, often without a company in the middle that can freeze an account. Instant swap services let users exchange one cryptocurrency for another quickly, with varying levels of identity checks. Redbord expects the hackers to break the funds into smaller pieces and launder them through smaller exchanges, a process he said could take months. Each of those hops passes through a platform that is not Binance and was not hacked, but now carries the burden of recognizing and refusing the funds.

That is the core of the containment problem. The compliance teams at mid-sized exchanges, the operators of swap services and the analytics firms that maintain address watchlists are now the frontline. Redbord described the funds as traceable “in real time” and said investigators can “disrupt and … seize back funds,” but he also called it “this cat and mouse game.” Recovery rates will depend less on Binance’s response than on how quickly flagged addresses reach every platform the money might touch, and on whether those platforms act on them.

Binance’s 90% Cushion and the Remaining Tenth

Binance said it held enough of the stolen currencies in reserve to cover 90% of the missing assets, and it promised full reimbursement. Holding reserves in the same assets that were stolen matters. Customers can be repaid in kind without the exchange having to buy bitcoin or other tokens on the open market, which can push prices up during a crisis.

By simple arithmetic, the remaining 10% of $6.3 billion is roughly $630 million. Binance has not said where that portion will come from: corporate funds, an insurance-style reserve, recoveries or some other source. It also has not given a timeline. The promise of full repayment is a strong one. How it will be funded is the detail that holders, counterparties and regulators will want to see.

Attribution Is Moving Faster Than Consensus

Blockchain firms pointed to a North Korean unit soon after the theft, and the FBI made a formal attribution within days. Asked about the case on Saturday, President Donald Trump said, “We don’t know if it’s North Korea,” while adding that it could yet be determined. Both positions deserve fair scrutiny. The FBI’s public statement names the actor and the laundering route but does not set out the underlying evidence. The president’s remark does not point to any contrary evidence. Readers should treat the attribution as the bureau’s formal finding, made early in an active investigation.

For practitioners, the question of who did it matters less for immediate action than it might appear. Blocklists work on addresses, not on nationality. An exchange can refuse funds from a flagged wallet whoever controls it. The FBI’s address list is useful to compliance teams today, whatever the final attribution.

Background

Binance is the world’s largest cryptocurrency exchange, a platform where customers buy, sell and hold digital currencies such as bitcoin and ethereum. Exchanges hold very large pools of customer assets, which makes them prime targets for well-resourced attackers. The FBI has attributed last year’s $1.5 billion Bybit theft, until now the record, to the same North Korean-linked actors it calls TraderTraitor.

Because blockchains record every transaction publicly, stolen funds can be followed across the ledger. Recovering them, however, depends on intermediaries such as exchanges and swap services refusing to process flagged funds. Blockchain analytics firms such as TRM Labs specialize in tracing these flows for investigators and compliance teams.

Sources

Source: FBI blames North Korea for stolen billions from Binance in biggest hack in history (AP News), reporting on the FBI’s attribution of the $6.3 billion Binance theft to North Korea’s TraderTraitor group.