Skip to main content
Merkle Street

Protocols, markets, policy, people

FBI links $6bn Binance theft to North Korea group

The FBI says North Korea’s TraderTraitor stole more than $6bn from Binance; investigators trace Ether swaps and urge crypto services to block laundering routes.

Merkle Street Newsroom#c5139c3 min read

FBI links $6bn Binance theft to North Korea group

The FBI says North Korea’s TraderTraitor group stole more than $6 billion from Binance on or about October 29, in the largest crypto theft in history. The bureau’s announcement names the group and asks crypto services to block transactions tied to addresses holding or moving the stolen assets. Blockchain analysis describes how funds left Binance’s wallets and how the attackers tried to move them.

How did the money leave Binance’s wallets?

Chainalysis says funds began leaving Binance hot wallets across several blockchains at about 4:20 p.m. Eastern on October 29. A hot wallet is an exchange wallet connected to online systems, used to hold and move crypto. On Ethereum, the attacker used an operational wallet funded through Tornado Cash to submit signed authorizations that let a Binance hot wallet run code deployed by the attacker. That code then moved the wallet’s assets to addresses controlled by the attacker. Other affected Binance wallets appear to have sent funds through signed transfers, according to Chainalysis’ account of the theft.

Across the affected blockchains, Chainalysis estimates the unauthorized transfers at about $6.4 billion. The FBI’s announcement gives a lower bound of more than $6 billion. The FBI says the group is TraderTraitor, while Chainalysis says funds stolen from Binance later commingled on-chain with funds from a separate theft it attributes to North Korea.

Why did the attackers swap stablecoins for Ether?

Some of the stolen funds were in stablecoins such as USDT and USDC, which their issuers can freeze. Bitcoin and Ether cannot be frozen by a token issuer in the same way. Chainalysis says the attacker moved $500 million in stablecoins to a wallet for swapping; over nearly 20 minutes, it exchanged $325 million of them for $285 million in Ether. About ten minutes later, the remaining $175 million in stablecoins went to other wallets.

The swap was a race against freezes. Stablecoin issuers, law enforcement and industry partners began freezing funds by 5:14 p.m. Eastern on October 29, Chainalysis reports. It said about $2.8 billion had been frozen as of 11:30 a.m. Eastern on November 3. That is a dated estimate, not a final recovery figure.

What does the FBI want crypto services to do?

The FBI, the US Secret Service and IRS Criminal Investigation are asking crypto businesses to block transactions involving addresses linked to the theft. The request includes operators of instant exchanges, DeFi services and blockchain analytics firms. The FBI has published crypto addresses it says are holding, or have held, stolen assets and are operated by or closely connected to TraderTraitor.

The bureau says it has observed the group converting stolen assets primarily into Ether and expects further laundering through DeFi and instant swap services. Those services let users exchange crypto through software or service providers. The FBI’s warning gives operators addresses to screen as funds move; Chainalysis says its investigation is continuing and that the stolen funds may keep moving.

Source material