FBI Says North Korea Behind $6.3 Billion Binance Hack

The FBI said North Korea carried out the theft of $6.3 billion from Binance and linked the operation to TraderTraitor actors.

The agency said the hackers moved stolen assets mainly into Ethereum and would likely use DeFi services and instant swaps to launder the rest. It also listed several cryptocurrency addresses tied to the theft and asked exchanges and analytics firms to block related transactions.

President Donald Trump said investigators do not know if North Korea is responsible. "We don't know if it's North Korea," he said.

Binance said it has covered 90 percent of the stolen assets using its secure asset fund, a bitcoin reserve, a futures insurance fund and its corporate treasury. The remaining 10 percent may take longer to replace, the company added.

The exchange restored withdrawals on several networks on Sunday after suspending them when funds started moving out of its wallets on Thursday. Deposits were never affected.

Richard Teng, Binance's co-chief executive officer, said more than one person carried out the hack. Binance's initial investigation suggested an engineer's laptop was compromised.

TRM Labs attributed the attack to TraderTraitor with high confidence. The co-founder and CEO of Chainalysis said the Binance hack was likely done by TraderTraitor, and analysts believe the group is part of the Lazarus Group. Experts say North Korea has turned to crypto theft to raise foreign currency under U.N. sanctions.

The investigation is ongoing.