FBI points finger at North Korea for $6B Binance attack
One stolen laptop, billions of dollars in damages: that’s one way to make a quick buck.
Image by Didem Mente/Anadolu/Getty Images
Follow us
- The FBI accused North Korea of stealing more than $6.3 billion from Binance.
- Binance said a compromised engineer’s laptop helped attackers submit unauthorized withdrawal transactions.
- Binance reserved over $6.34 billion to cover user losses and restored withdrawals gradually.
- The FBI urged crypto platforms to block wallets linked to North Korean TraderTraitor actors.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
The Federal Bureau of Investigation (FBI) is accusing the Democratic People’s Republic of Korea (DPRK) of stealing over $6.3 billion from Binance.
On October 29th, hackers stole over $6.3 billion from Binance, the cryptocurrency trading platform.
As a precaution, deposits and withdrawals were suspended while cybersecurity specialists conducted security checks.
Binance’s initial investigation suggested that the incident involved a compromised DevOps engineer’s laptop, which allowed attackers to access a service container and submit unauthorized withdrawal transactions. Subsequent investigation uncovered additional points of breach.
Binance promised to cover all losses from its Secure Asset Fund for Users (SAFU) and the company’s funds. The cryptocurrency trading platform has already reserved over $6.34 billion to cover the incident.
On Sunday, withdrawals were restored progressively.
Although Binance didn’t say who was behind the theft, which has been labeled as the largest hack of a cryptocurrency trading platform in history, the FBI claims that North Korea was responsible.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
According to the US intelligence agency’s latest Cyber Alert, a North Korean threat actor called “TraderTraitor” converted the stolen bitcoins into Ethereum, as the attackers prepare for “further laundering stages.”
The FBI has shared dozens of bitcoin and Ethereum addresses that are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors.
The agency is calling on cryptocurrency platforms to block transactions to and from those addresses.
TraderTraitor is a state-sponsored threat actor from North Korea and is primarily associated with cryptocurrency theft, financial cybercrime, and attacks against blockchain-related businesses.
TraderTraitor’s tactics, techniques, and procedures (TTPs) involve social engineering, spear-phishing, malware, and exploitation of software vulnerabilities.
Early last year, the FBI had already identified a North Korean hacking group as the culprit behind a hack at the popular cryptocurrency exchange ByBit. In that incident, $1.5 billion in cryptocurrency was stolen.
