FBI Accuses North Korea in $6 Billion Binance Crypto Theft

The Alleged Cybercrime

The FBI claims North Korea orchestrated a major cryptocurrency heist from Binance, reportedly stealing over $6 billion. This crime might be one of the biggest publicly identified cryptocurrency hacks.

According to the FBI’s cyber alert last Saturday, the hack occurred around October 29. The investigation, involving the U.S. Secret Service and IRS Criminal Investigation, revealed that hackers mainly converted stolen assets into Ethereum. The funds are expected to move through decentralized finance platforms and instant-swap services in laundering efforts.

North Korea’s Role and FBI’s Actions

The FBI stated the Democratic People’s Republic of Korea was behind the Binance theft. Calls from the bureau have gone out to cryptocurrency platforms and operators to block transactions linked to the North Korean addresses involved.

This activity is linked to the “TraderTraitor” campaign, aimed at funding North Korea’s regime by stealing high-value cryptocurrencies, according to U.S. authorities. The incident highlights North Korea’s increasing reliance on cybercrime and digital asset theft to circumvent international sanctions and fund weapons programs.

Authorities urge anyone with knowledge of the theft or laundering to contact their local FBI office or reach out via the Internet Crime Complaint Center.

Insights on the Hack

Kathryn Westmore of UK Finance believes the hack was orchestrated by TraderTraitor, although other platforms have also been targeted by this group. Personal device security by users could have influenced whether their wallets were accessed.

Binance indicated that the hackers gained systems access through the compromised laptop of a software engineer. This provided them the opportunity to authorize withdrawals.

Despite Binance having faced a previous heist in 2022, where a hacker created 2 million BNB tokens worth around $570 million, the attacker still managed to walk away with over $100 million.

Details of the Attack

TRM Labs suggests the attack took 36 hours to set up, starting with several small withdrawals from Tornado Cash. Later, hackers launched code targeting wallets. They tested the code on a third wallet before funneling funds back to their accounts.

In a swift four-minute operation, hackers transferred 233.46 million XRP, depleted Binance hot wallets, and targeted wallets on Optimism and Solana. A significant 18,270 BTC was then transferred and split using a peel chain, a method that hides fund movement.

The attackers took 612.7 million USDT and 46.4 million TRX from a Binance wallet on Tron.

Advice for Binance Users

Westmore warns of likely fraudulent activities where imposters may offer to help victims recover stolen funds for payment. According to Binance, users’ funds should remain secure, but vigilance is advised regarding potential personal data breaches and misuse.

Binance promises to cover the hack’s financial impact.