The Federal Bureau of Investigation has formally linked North Korea to the theft of a record $6.3 billion in virtual assets from cryptocurrency exchange Binance.
In a statement issued on Saturday, the U.S. agency attributed the massive cyber operation to a group known as TraderTraitor. The same collective has previously been blamed by authorities for a $1.5 billion heist targeting the Bybit platform in February of last year. Investigators observed malicious actors laundering the stolen capital by converting the digital assets primarily into Ethereum, warning that the funds are expected to undergo further staged laundering.
In response to the security breach, the FBI called on virtual asset service providers to block transactions connected to the ongoing laundering operation, issuing specific digital addresses for platforms to monitor.
Binance, which operates the world’s largest cryptocurrency exchange, reported on Saturday that it has already replaced 90 percent of the stolen sum by utilizing company reserves to purchase new tokens. The remaining 10 percent comprises less liquid assets that are anticipated to require more time to reacquire. Company representatives stated that Binance will absorb the financial impact entirely to shield its customer base.
“We will continue to buy the remaining relevant token assets… until the covered amount reaches 100 [percent] for all tokens. Binance will absorb the financial impact of these stolen funds, not our users,” the company said in a statement posted on social media platform X.
The capital used to repurchase the tokens was drawn from the Secure Asset Fund for Users, a $1 billion Bitcoin reserve established to protect customers during security incidents, alongside portions of the company’s Futures Insurance Fund and corporate treasury. Cryptocurrency markets experienced a downturn on Friday as the exchange moved to stabilize sentiment and reassure traders.
Binance Co-CEO Richard Teng described the security breach on Friday as a sophisticated and complex operation involving a compromised laptop and malicious software engineered to erase activity logs, complicating tracing and forensic investigation. Following the incident, the platform temporarily suspended customer withdrawals.
Operations are moving toward normalization, with Binance announcing late Saturday that it remains on track to resume standard withdrawals on Sunday. The exchange also published an updated proof-of-reserves snapshot to enable users to verify independently that all customer holdings remain backed at a minimum one-to-one ratio.
