The stolen assets included Bitcoin, Ethereum, and stablecoins such as Tether and USD Coin. According to the FBI, TraderTraitor actors were observed converting the stolen assets primarily into Ethereum. The agency expects these assets to be further laundered using decentralized finance (DeFi) and instant swap services. To counter this, the FBI has issued a request for crypto exchanges and blockchain analytics companies to block transactions linked to specific digital addresses associated with the laundering operation.
Binance, the world’s largest crypto exchange by daily trading volume, confirmed that it had used company funds worth over $6.34 billion to replace 90 percent of the stolen tokens. The remaining 10 percent consists of less liquid tokens, which may take longer to purchase. Co-CEO Richard Teng stated that the company is committed to covering the remaining amount, emphasizing that “users will not bear the financial impact of this incident.” The funds used for the replenishment came from Binance’s $1 billion Secure Asset Fund for Users (SAFU), part of its Futures Insurance Fund, and the company’s corporate treasury.
Teng described the breach as a “complex attack” involving a compromised laptop and malicious software designed to delete evidence, which complicated the investigation. Following the incident, Binance suspended customer withdrawals but announced on Saturday that it was on track to reopen them on Sunday. The exchange also published a new proof-of-reserves snapshot to allow users to independently verify that their assets are backed at a minimum 1:1 ratio.
The news of the cyberattack caused significant volatility in the cryptocurrency market, with prices of major assets slumping on Friday. Bitcoin plunged nearly 5 percent, Ethereum dropped nearly 6 percent, and Binance’s native token, BNB, tumbled nearly 10 percent. The scale of the heist has intensified concerns regarding the capacity of North Korea, which faces extensive international sanctions, to generate illicit revenue. Additionally, the incident has raised broader worries among observers that the expanding capabilities of artificial intelligence models could potentially compromise cryptography and IT security protocols.
TraderTraitor is part of the Lazarus Group, which gained notoriety in 2014 for hacking Sony Pictures. The FBI’s statement serves as a formal attribution of the attack, distinguishing it from earlier suspicions raised by private investigators. The agency’s call for industry cooperation highlights the collaborative effort required to trace and freeze digital assets in the event of state-sponsored cybercrime.
Binance has stated that its priority is to fully restore customer confidence and ensure the integrity of its platform. The resumption of withdrawals is a critical next step in normalizing operations. As the investigation continues, the focus remains on tracking the flow of the remaining stolen assets and preventing their integration into the broader financial system through laundering stages.
