FBI Officially Attributes Binance's $6.3 Billion Hack to North Korea

The FBI has officially identified North Korea as the party behind the $6.3 billion Binance hack. On October 31 (local time), the FBI stated that the hack was the work of North Korea.

According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), TraderTraitor, the group named by the FBI, is a North Korean state-sponsored hacking group linked to cryptocurrency theft since at least 2020. CISA explained that the Lazarus Group has attacked the blockchain and cryptocurrency industries through spear phishing and malware, and that TraderTraitor is believed to be part of the Lazarus Group.

On October 31, Binance announced via X (formerly Twitter) that it had covered 90% of the stolen assets with company funds. The remaining 10%, it explained, consisted of tokens with low liquidity that would take longer to secure. Co-CEO Richard Teng said, "Users will not bear the financial impact of the incident."

Binance suspended both deposits and withdrawals before announcing the resumption of withdrawals on November 1. The Bitcoin network was opened first in the initial phase. Binance took a new Proof-of-Reserves snapshot as of 00:00 UTC on Saturday and informed holders of 10 tokens, including BTC, ETH, and USDT, that they could directly verify whether their assets were backed at a minimum ratio of 1:1.

The FBI asked THORNode operators, RPC node operators, instant exchange services, DeFi services, blockchain analytics firms, and others to block addresses suspected of being used by TraderTraitor for laundering, as well as transactions derived from those addresses, and published hundreds of cryptocurrency addresses linked to the incident.