The theft of billions of dollars from Binance within a matter of minutes, the biggest crypto heist in history, was orchestrated by North Korean hackers, the FBI said Saturday.
The bureau said in a statement that this week’s attack was tied to “malicious cyber activity” by an entity known as TraderTraitor, the same actors behind a $1.5 billion Bybit hack last year.
The FBI asked crypto exchanges, blockchain analytics companies and others to block transactions linked to various addresses to make sure the money is not laundered to cover up its origins.
It also said its probe found that TraderTraitor was converting stolen assets primarily into a cryptocurrency called Ethereum.
The FBI expects that TraderTraitor will now attempt to convert the assets using DeFi and “instant swap services.”
Asked by reporters as he appeared on Saturday night during a Halloween party at his Mar-a-Lago estate in Florida, however, President Donald Trump suggested investigators weren’t yet certain that North Korea was involved.
“I’m not concerned. We’re learning about it,” Trump said of the case. “We don’t know if it’s North Korea.” Though he added that, it could yet be determined that it was.
Crypto expert Ari Redbord said he expects the hackers will break the stolen assets into pieces and try to launder them through smaller exchanges to evade detection, a process that could unfold over months.
“It’s bank robbery, in this case, at the speed of the Internet,” said Redbord, chief policy officer at blockchain intelligence firm TRM Labs. “However, we can also track and trace those funds in real time in order to build investigations, to disrupt and to seize back funds.”
He added: “It’s just this cat and mouse game.”
On Thursday, $6.3 billion in bitcoin and other digital currency was stolen from Binance, the world’s largest crypto exchange, in what several crypto experts said bore the hallmarks of a North Korean hack.
The company said Saturday that it had enough set aside in the same digital currency that was stolen to cover 90% of the missing assets and promised that customers would be fully reimbursed.
