The FBI has linked North Korea to the theft of a record $6.3bn in virtual assets from cryptocurrency exchange Binance.
Malicious actors from North Korea were observed laundering the stolen assets by converting them primarily into the cryptocurrency Ethereum, the FBI said in a statement on Saturday.
The US agency blamed the operation specifically on a group called TraderTraitor, the same group blamed for a $1.5bn theft from the Bybit platform in February last year.
According to the statement, the assets are expected to be “further laundered” in stages.
The FBI called on virtual asset service providers to block transactions being used in the latest laundering operation, providing the suspected digital addresses to watch for.
In a separate statement on Saturday, Binance said it has replaced 90 percent of the amount stolen by using company money to buy new tokens.
The remaining 10 percent consists of less liquid tokens, meaning they may take longer to buy, it added.
“We will continue to buy the remaining relevant token assets… until the covered amount reaches 100 [percent] for all tokens. Binance will absorb the financial impact of these stolen funds, not our users,” the company said on X.
The money spent re-buying tokens came from a $1bn Secure Asset Fund for Users (SAFU), a Bitcoin reserve fund Binance holds to protect customers in the event of security breaches, as well as some of its Futures Insurance Fund and the company’s corporate treasury.
Crypto prices fell on Friday, as Binance, which runs the world’s largest crypto exchange, sought to reassure customers their funds were safe.
Binance co-CEO Richard Teng said on Friday that the breach was a “complex attack” involving a compromised laptop and malicious software designed to delete evidence of its activity, making it hard to trace and investigate.
After the hack, the exchange stopped allowing customers to withdraw their funds.
Binance said later on Saturday that it was on track to reopen withdrawals on Sunday.
Binance also announced the publication of a new proof-of-reserves snapshot, allowing users to independently verify that their assets were backed at a minimum 1:1 ratio.
