FBI blames North Korea for $6.3bn Binance crypto heist

The FBI has accused North Korea of stealing more than $6 billion in cryptocurrency from Binance, as the world's largest crypto exchange began restoring withdrawals after using company funds to replace most of the stolen assets.

The exchange said on Saturday it had set aside more than $6.34 billion to cover the losses and had replenished around 95 per cent of the stolen tokens. Bitcoin withdrawals resumed in phases on Sunday, with other cryptocurrencies to follow.

In a statement, the FBI attributed the October 29 attack to TraderTraitor, a group linked to North Korea. The agency said its investigators had observed the hackers converting the stolen assets into Ethereum and expected them to use decentralised finance platforms and instant swap services to launder the funds.

It urged private-sector companies to block transactions involving cryptocurrency addresses used by the group.

The FBI's statement confirmed earlier assessments by private investigators and analysts. TraderTraitor has also been blamed for stealing $1.5 billion from the Bybit cryptocurrency platform in February last year.

US President Donald Trump, however, said it was too early to establish North Korea's involvement.
"I'm not concerned. We're learning about it. We don't know if it's North Korea," he told reporters at his residence in Florida late Saturday.

Binance said it had used its own funds to purchase replacement tokens, with the remaining five per cent comprising less liquid assets that could take longer to source in the required quantities.

The exchange had suspended withdrawals following what it described as a "complex attack" involving several "points of breach". It announced on its status page shortly after 0600 GMT on Sunday that withdrawals had resumed for an initial group of 15 cryptocurrencies, including Bitcoin, Ether, XRP and Dogecoin.

The attack sent major cryptocurrencies lower on Friday, with Bitcoin falling nearly five per cent, Ethereum losing around six per cent and Binance's native BNB token declining almost 10 per cent.

The scale of the theft has renewed concerns over cryptocurrency security and North Korea's ability to generate funds through illicit activities despite international sanctions over its nuclear and missile programmes.

TraderTraitor is believed to be associated with the Lazarus Group, which was accused of hacking Sony Pictures in 2014 in retaliation for the film "The Interview", which mocked North Korean leader Kim Jong Un.

The Binance incident adds to a series of major cryptocurrency thefts. Researchers at TRM Labs estimated that attackers stole $2.9 billion in digital assets in nearly 150 incidents last year.