The U.S. Federal Bureau of Investigation (FBI) has accused North Korea of orchestrating the theft of over $6 billion in digital assets from the cryptocurrency exchange Binance. This breach is believed to be one of the largest publicly known cryptocurrency hacks.
The attack occurred on or about October 29, as stated in a cyber alert released by the FBI.
Collaborating with the U.S. Secret Service and IRS Criminal Investigation, the FBI reported the hackers have converted the stolen assets primarily into Ethereum. Authorities caution that these assets are likely to be processed through decentralized finance platforms and instant-swap services as part of an extensive laundering effort.
In the alert, the FBI explicitly named the Democratic People’s Republic of Korea (North Korea) as responsible for the theft. Newsweek reached out to the FBI, Binance’s CEO, and North Korea’s United Nations mission for comments.
Address Blocking Initiatives
The FBI has advised cryptocurrency companies, blockchain analytics firms, decentralized finance services, exchange operators, and node operators to block transactions linked to a list of addresses allegedly controlled by North Korean actors. This activity is part of the persistent North Korean cyber campaign known as “TraderTraitor,” associated with high-value cryptocurrency thefts meant to generate revenue for the regime.
The announcement highlights increasing concerns among U.S. officials regarding North Korea’s use of cybercrime and digital asset theft to circumvent international sanctions and acquire foreign currency. North Korea is recognized as a prolific state-backed cryptocurrency thief, and U.S. agencies frequently warn that stolen digital assets significantly fund its weapons and military programs.
If you possess any information related to the theft or laundering of the stolen assets, contact a local FBI field office or submit details through the Internet Crime Complaint Center (IC3).
Binance Responds to Compromised Laptop Incident
Kathryn Westmore, director of financial crime at UK Finance, confirmed North Korea’s involvement in the hack, noting that “TraderTraitors” is suspected of being a state-sponsored North Korean hacking group with a history of attacks on various platforms.
In response, Binance, the world’s largest cryptocurrency exchange by trading volume, initiated an investigation into the security breach. Initial results indicate that the laptop of a software engineer was compromised, allowing hackers access to the platform’s systems and enabling unauthorized withdrawals.
Previously, Binance experienced a hacking incident in 2022, during which 2 million BNB tokens, valued at approximately $570 million, were artificially created and partially stolen.
Details of the Hack
TRM Labs, a blockchain company, believes the attack took 36 hours to set up, beginning with small withdrawals from Tornado Cash, a service that conceals the origins of cryptocurrencies. Hackers then used code to target two wallets and tested it on a third before transferring the assets.
During the hack, which lasted just four minutes, between 8:05 p.m. and 8:09 p.m., hackers directed 233.46 million XRP from five Binance hot wallets to their own addresses. Subsequently, they targeted wallets on Optimism and Solana, and by 8:20 p.m., 18,270 BTC were transferred from a Binance Bitcoin hot wallet; the BTC pieces were divided, using a method called “peel chain” to disguise the transaction paths.
Beyond BTC, hackers redirected 612.7 million USDT and 46.4 million TRX from a Binance hot wallet on Tron.
Advice for Binance Users
Kathryn Westmore warned of possible scams targeting Binance users following the hack, including requests for payments to assist in recovering assets, which is not possible. She emphasized that Binance users’ funds should be secure based on the company’s claims, though potential breaches of personal data remain uncertain. Users should be vigilant for any misuse of personal information.
Binance has promised to cover the costs associated with the hack, ensuring financial protection to its users.
Leave a Reply