Stolen assets converted to Ethereum as further laundering warned

Binance says it has replenished 90% of shortfall using own funds

[Reuters]
[Reuters]

The US Federal Bureau of Investigation has officially blamed North Korea for the hack of Binance, the world's largest digital asset exchange, in which $6.3 billion was stolen. US investigators confirmed that North Korean hackers converted the stolen assets into Ethereum as part of a money-laundering operation and warned that further movement of the funds is expected.

The FBI said Saturday (local time) that North Korea was responsible for the theft of more than $6 billion in digital assets from Binance. The announcement was the first official confirmation by US authorities of North Korean involvement, following widespread speculation among blockchain analytics firms after the hack occurred Thursday.

The FBI said North Korean hackers have been laundering the stolen digital assets by converting them into Ethereum, and warned that additional laundering of the stolen funds is anticipated.

Earlier, US blockchain analytics firm TRM Labs identified North Korean hacking group TraderTraitor as the perpetrator. TRM Labs said the hackers stole approximately $6.36 billion in digital assets across multiple blockchain networks operated by Binance, with most of the funds drained within roughly 20 minutes.

Chainalysis also raised the possibility of TraderTraitor's involvement, saying it had detected on-chain mixing of funds stolen in the Binance hack with those taken in last month's Bitget hack.

TraderTraitor is the North Korean hacking group also linked to the Bybit hack in February last year, in which approximately $1.5 billion worth of Ethereum was stolen. The FBI officially attributed that attack to North Korea as well.

The scale of the Binance hack is more than four times that of the Bybit incident, making it the largest known hack of a digital asset exchange on record.

Following the hack Thursday, Binance suspended withdrawals to prevent further asset outflows and began recovery efforts. Stablecoin issuers including Tether and Circle moved to freeze the stolen assets, and Binance said approximately $3 billion in related assets had been frozen.

An investigation into how the breach occurred is ongoing. Binance initially suggested that a DevOps engineer's laptop may have been compromised, but later disclosed that additional entry points had been discovered during follow-up investigations. The specific attack vector and method have not yet been determined.

Binance said it plans to cover losses using its own funds and its Secure Asset Fund for Users, known as SAFU, to guarantee the safety of customer assets. SAFU is an emergency reserve fund Binance established in 2018 to protect user assets against unforeseen incidents such as hacks, funded by setting aside a portion of trading fees.

Binance said Saturday (local time) that it had replenished approximately 90% of the shortfall from the stolen assets. For 10 major digital assets — including Bitcoin, Ethereum, Tether (USDT) and XRP — Binance said it had secured reserves equivalent to 100% of customer holdings. The remaining 10%, consisting of lower-liquidity tokens, will be acquired through market purchases and over-the-counter trading.


kyoung@heraldcorp.com