FBI names North Korea's TraderTraitor group behind $6.3 billion Binance theft

Bitcoin slid to $76,000 range before recovering to $77,000 range Sunday morning

Ether, XRP, Solana and BNB tumble then pare losses; Binance says it has covered 90% of damages

[Reuters]
[Reuters]

The virtual asset market was rattled by a massive theft at Binance attributed to a North Korea-linked hacking group. Bitcoin fell below the $80,000 mark and at one point dropped to the $76,000 range, while Ether, XRP, Solana and BNB all tumbled in tandem. After Binance said it had covered 90% of the losses, major coin prices recovered some ground, but the market remains unsettled below $80,000.

The FBI said Saturday that North Korea was behind the theft of more than $6 billion in virtual assets from Binance, attributing the cyberattack to the North Korea-linked hacking group TraderTraitor. Blockchain analytics firm TRM Labs said assets worth approximately $6.36 billion moved across 10 blockchains, with most of the funds drained within about 20 minutes.

At 9:20 a.m. Friday, when news of the hack broke, Bitcoin was trading at $77,241 on CoinMarketCap, down 4.84% from 24 hours earlier. Ether fell 5.67% to $2,290, while XRP and Solana dropped 7.14% and 7.49%, respectively. Binance Coin (BNB) tumbled 9% to $690. Bitcoin later slid further to $76,400. Liquidations in the virtual asset futures market reached $1.57 billion.

Major coins recovered some of their losses Sunday morning. At 4:59 a.m., according to TokenPost Market, Bitcoin was up 0.83% from Saturday at $77,433, while Ether gained 0.69% to $2,249. At the same time, XRP rose 0.20%, BNB gained 0.89% and Solana climbed 1.02%. Despite the partial rebound, Bitcoin remains below $80,000.

Binance confirmed the hack caused approximately $6.3 billion in losses and moved to protect user assets. On Saturday, the exchange said it had covered about 90% of the losses using corporate funds, its Secure Asset Fund for Users (SAFU) and a futures insurance fund. Binance said it had secured 100% reserves for major virtual assets including Bitcoin, Ether, USDT, USDC, BNB, XRP and Solana, and was continuing to buy the remaining 10% — held in lower-liquidity coins — through both on- and off-exchange purchases. The exchange reiterated that it would not pass any losses on to users.

The FBI warned that the attackers are primarily converting stolen assets into Ether and may launder them further through decentralized finance (DeFi) platforms and instant exchange services. TRM Labs said the attackers exploited Ethereum wallet functionality to move assets out of Binance's hot wallets. Stablecoin issuers Tether and Circle, along with blockchain firms, froze related assets, and authorities asked the industry to block transactions linked to suspected wallet addresses.

Binance suspended some deposits and withdrawals for security checks and damage assessment, with a target of resuming service Sunday. The incident highlighted how a security breach at a single exchange can rapidly ripple through major coin prices and derivatives liquidations. Even with the announcement that most losses have been covered, the prospect of further movement and laundering of funds tied to North Korean hacking activity means market caution is likely to persist for now.


attom@heraldcorp.com