Billions Vanish in Minutes; FBI Wants the Exchanges to Cop

The world's largest crypto exchange lost $6.3 billion in about the time it takes to boil an egg, and the bill, Binance says, will land on Binance. Not on you. That's the promise, anyway, and it came wrapped in a press release.

The FBI said Saturday that North Korea's TraderTraitor group was behind the theft, which hit on or about October 29, three days before the bureau's cyber alert went out. "The Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance," the FBI said. The bureau worked with the U.S. Secret Service and IRS Criminal Investigation, a three-agency pile-on for a heist of other people's money.

Who Has the Power

Here's what the alert actually asks for: that crypto exchanges, blockchain analytics firms, decentralized finance services, exchange operators and node operators block transactions tied to a list of addresses the FBI says North Korean actors control. A state agency hands private companies a blacklist and expects them to enforce it. Anyone with information is told to call a local FBI field office or file through the Internet Crime Complaint Center.

The bureau's framing is geopolitical. U.S. officials, the article notes, are worried about North Korea's reliance on cybercrime to evade international sanctions and get foreign currency, with stolen assets feeding weapons and military programs. States robbing banks to fund armies. States chasing states. Neither side is you.

And the attribution isn't airtight. Asked at a Halloween party at Mar-a-Lago, President Donald Trump said: "I'm not concerned. We're learning about it. We don't know if it's North Korea." The FBI had already said it was. The head of the executive branch and his own police bureau, publicly out of sync.

What They're Calling "Security"

How'd it happen? Binance co-CEO Richard Teng called it a "complex attack" involving a compromised laptop and malicious software built to delete evidence of its own activity. The company's initial investigation pointed to the laptop of a software engineer, which let hackers in and ultimately green-light withdrawals. One employee's machine. One door. Billions gone.

TRM Labs says the preparation took around 36 hours, starting with three small withdrawals from Tornado Cash. Then the speed: in four minutes, between 8:05 p.m. and 8:09 p.m., five Binance hot wallets sent 233.46 million XRP to a hacker address, each left with only its minimum balance. At 8:20 p.m. a Bitcoin hot wallet was taken over, and 18,270 BTC were split into 1,000 BTC and 100 BTC pieces in what's called a "peel chain." Finally, 612.7 million USDT and 46.4 million TRX went out from a wallet on Tron.

The same group hit Bybit for $1.5 billion in February last year. Binance was robbed in 2022 too, when a hacker created 2 million BNB tokens worth around $570 million and still walked off with over $100 million, four years ago now. The vault keeps getting cracked. The vault keeps getting rebuilt.

Who Pays

Binance froze customer withdrawals after the hack, and crypto prices fell Friday as the company scrambled to reassure users their funds were safe. Saturday it said it had replaced 90 percent of the stolen amount with company money. The remaining 10 percent is in less liquid tokens that may take longer to buy. "Binance will absorb the financial impact of these stolen funds, not our users," the company said on X.

The cash came from a $1 billion Secure Asset Fund for Users, a Bitcoin reserve, plus some of its Futures Insurance Fund and the corporate treasury. Withdrawals are set to reopen Sunday, alongside a new proof-of-reserves snapshot so users can verify their assets are backed at a minimum 1:1 ratio. Note the arrangement: users are asked to trust the exchange's own audit tooling, after the exchange got robbed.

Kathryn Westmore, director of financial crime at UK Finance, said users' own device security could affect whether their wallets were targeted. She also warned that "it's highly likely that we're going to see a wave of fraudsters contacting potential victims and asking for payment to help them get their money back (which they can't do)." And nobody knows what personal data may have been breached, so people should watch for signs it's being used by criminals or sold.

The Cat-and-Mouse Business

Ari Redbord of TRM Labs, a blockchain intelligence firm, called it "bank robbery, in this case, at the speed of the Internet." He expects the hackers to break the assets into pieces and launder them through smaller exchanges, a process that could take months. "It's just this cat and mouse game," he said. The FBI expects TraderTraitor to convert the loot, primarily into Ethereum, and push it through DeFi and "instant swap services."

So the cycle runs: private exchange gets hit, state agency issues a watch list, analytics companies sell tracking, the money slides through the cracks. Round and round, and the only fixed point is that the pile of concentrated wealth is what everyone's circling.