Binance Reopens Withdrawals After $6.3bn Hack
Binance has begun letting users withdraw again and says it has refilled 90% of the stolen funds. The FBI names a North Korean group as the culprit.
The $6.3bn (£4.7bn) theft from Binance now has an official suspect. The FBI blamed North Korea on Saturday, and the exchange says most of the losses are already covered as it lets users withdraw funds again.
The FBI names TraderTraitor
Private investigators and analysts had already suspected a North Korea-affiliated group. The FBI confirmed it. Its statement says North Korea was responsible for stealing more than $6bn in virtual assets from Binance, on or about October 29.
The group is called TraderTraitor. It is believed to be part of the Lazarus Group, which gained notoriety in 2014. Lazarus was then accused of hacking Sony Pictures as revenge for The Interview, a film that mocked leader Kim Jong-un.
The bureau says it has observed TraderTraitor actors turning stolen assets into ethereum. It expects the money to be laundered further through decentralised finance and instant swap services. Private companies are urged to block transactions with addresses the group uses for that.
North Korea is under wide international sanctions tied to its nuclear and missile work. The scale of the theft has drawn attention to how the country gets around them to bring in money.
How Binance is covering the loss
Binance says it set aside about $6.34bn of company funds. With that, it has replenished 90% of what was stolen.
The remaining 10% is in tokens that are less liquid, so buying them back may take longer. Binance explained this in a post on X.
Part of the money came from the $1bn Secure Asset Fund for Users, a bitcoin reserve held for security breaches. The company also used some of its Futures Insurance Fund and its own corporate treasury.
Co-chief executive Richard Teng said Binance was "committed to covering the remaining 10%". Users, he said, would not bear the financial impact of the hack.
Withdrawals return in phases
Withdrawals were frozen while Binance investigated. On Sunday the exchange announced a phased reopening, starting after 2pm Singapore time.
Holders of ethereum, USDT and USDC tokens on the ethereum blockchain can take their funds out in the first phase. So can holders of some other assets on the BNB Smart Chain.
What is known about the attack
Teng called it a "complex attack" on Friday. A compromised laptop was involved, along with malware meant to wipe its own traces, which complicates the investigation.
Prices dropped after the news. Bitcoin lost nearly 5%, ethereum nearly 6%, and BNB, the token native to Binance, nearly 10%.
The attack came while many observers voice worries that increasingly capable AI models could compromise cryptography and IT security protocols. The report does not link the two.
Our View
The first test is whether Binance buys back the last 10% as promised, and how the later phases of the reopening go. The company has promised to cover the remaining 10%, and the reopening is described as phased.
The FBI's request for blocks on laundering addresses also depends on other firms. How many of them comply will shape how much of the stolen money can still be traced before it passes through swap services.
Source: the Guardian