Federal law enforcement has directly attributed a record-breaking $6.3 billion virtual asset theft targeting the cryptocurrency exchange Binance to North Korean threat actors. In a public statement issued on Saturday, the agency identified the perpetrators as members of the group known as TraderTraitor, which has previously been implicated in major cyber heists, including a $1.5 billion breach of the Bybit platform in February of last year.
According to federal findings, the hackers have begun laundering the stolen holdings by converting the assets primarily into Ethereum. Investigators warned that the illicit funds are anticipated to undergo further laundering in multiple stages. In response, authorities urged virtual asset service providers to monitor and block transactions associated with the ongoing laundering scheme, while publishing a list of suspected digital addresses for industry-wide tracking.
The massive security breach prompted an immediate financial response from Binance, which operates the world’s largest cryptocurrency exchange. In a separate statement released Saturday, the company announced it has already replaced 90 percent of the stolen amount by deploying corporate funds to purchase new tokens. The remaining 10 percent comprises less liquid assets that are expected to require more time to reacquire.
“We will continue to buy the remaining relevant token assets… until the covered amount reaches 100 [percent] for all tokens. Binance will absorb the financial impact of these stolen funds, not our users,” the company stated on the social media platform X.
Binance reported that the capital used to repurchase the tokens was drawn from its Secure Asset Fund for Users, a $1 billion Bitcoin reserve established to safeguard customer accounts during security incidents. Additional funds were pulled from the company’s Futures Insurance Fund and corporate treasury reserves. Broader market reactions included a drop in cryptocurrency prices on Friday as the exchange moved to reassure its user base that their capital remained secure.
Offering technical details regarding the intrusion, Binance co-CEO Richard Teng described the incident on Friday as a “complex attack” centered on a compromised laptop. The attackers utilized malicious software engineered to scrub evidence of their operations, complicating investigative and tracing efforts.
In the wake of the hack, Binance temporarily suspended customer withdrawals. However, the exchange confirmed late Saturday that it remains on schedule to resume normal withdrawal operations on Sunday. Additionally, Binance released an updated proof-of-reserves snapshot designed to enable users to independently verify that their holdings maintain a minimum 1:1 asset-backing ratio.
