Light Mode
Dark Mode
System Mode
Binance suffers a $6B+ hack attributed to TraderTraitor group; investigation, impact and security responses underway.
The U.S. Federal Bureau of Investigation confirmed that North Korea’s TraderTraitor hacking group carried out a theft from Binance that exceeded $6 billion, and urged the crypto community to block transactions from hundreds of addresses that at one point held stolen funds.
The FBI said the hackers have been converting the stolen assets mainly into ether. The agency warned that the attackers are likely to use swap services and other decentralized finance tools to continue laundering the funds. The FBI called on private sector entities, including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions involving addresses tied to TraderTraitor actors.
The FBI listed over 600 Ethereum addresses, just under 20 Bitcoin addresses and a single Solana address in its notice. Analysts and services attributed the attack that took place on Thursday to TraderTraitor, a subunit of the Lazarus Group. Stablecoin issuers froze over $2.4 billion of the stolen funds, while Binance said it replenished 90% of the stolen cryptocurrencies and planned to resume customer withdrawals on Sunday.
Chainalysis CEO Jonathan Levin stated that the attackers have used thousands of addresses and predicted the number could expand to tens of thousands as the money is funneled through a broader laundering network. The firm reported that the transaction volume suggested the use of automated tools to obscure the trail by circulating funds between addresses before onward transfers. U.S. President Donald Trump commented that the administration was learning about the incident and that it would talk to North Korea about it.
The FBI confirmation of TraderTraitor responsibility and the listing of hundreds of addresses signal a coordinated effort to both identify and disrupt the laundering chain. The continued conversion of stolen assets into ether and the predicted expansion of laundering addresses indicate that attackers are relying on a diverse set of DeFi and swapping services to move funds. The freezing of over $2.4 billion in stablecoins and Binance’s reimbursement of 90% of funds show both the industry’s defensive responses and the scale of resources required to mitigate such breaches.