According to an FBI cyber alert posted Saturday, North Korea was responsible for the Binance theft of more than $6 billion in virtual assets, on or about 29 October. The bureau’s name for that operation is TraderTraitor.
Friday’s public FBI comment, carried in an earlier PTYcoin story, said the bureau was aware of the incident and named no attacker. Saturday’s alert is the first public attribution from the US government. Chainalysis had already assessed the theft as the work of TraderTraitor. Yonhap reported that TRM Labs had reached a similar conclusion before the FBI notice.
With the US Secret Service and IRS Criminal Investigation, the FBI says it has watched the actors it names turn most of the stolen coins into ether. The alert says a further round of laundering is expected after that, using decentralized-finance tools, software that swaps and lends coins without a company in the middle, and instant-swap services, which trade one token for another on the spot. It asks THORNode operators, RPC node operators (the servers apps query to read a blockchain), instant exchanges, those DeFi services, analytics firms, and other virtual-asset businesses to block transfers that touch addresses on a list in the alert.
TokenPost counted roughly 525,200 ether in wallets it links to the attacker at 12:51 p.m. Eastern on Saturday, about $3.1 billion. About 200,600 of that ether came straight out of Binance, it said, and swaps supplied the rest. At that hour, none of it had moved to an exchange deposit address or a mixer, a service that blends coins so the path is harder to follow. TokenPost says labels of this kind can be incomplete or wrong. The tally sits apart from the coins Binance has been buying to restock customer accounts.
In its Saturday notice, Binance said newly purchased coins now match 90% of Thursday’s loss. A day earlier the matched share was near 80%. The ten with full backing are bitcoin and ether, Tether USDT, BNB, solana, USDC from Circle, XRP, USD1, RLUSD, and ZEC. Buying goes on in the open market and in OTC trades, private deals made away from the public book, until each affected token is matched. Coins outside that list make up the unmatched tenth. Binance said they trade thinly, so the amounts still wanted may take longer to find. Partners at other companies are helping line up the remaining buys, and Binance said further updates will come as that work continues. The bill, Binance said, stays with the company.
The 90% is Binance buying coins so the balances customers see have assets behind them again. CNBC reported that figure as a refill of customer backing, separate from coins the attacker still holds.
Three pools fund the refill, the notice says. Part of SAFU, the Secure Asset Fund for Users, a reserve Binance opened in July 2018 for emergencies, is expected to move within a day toward tokens still short of a full match. The notice points to a public balance for that fund. Part of the futures insurance fund moved too. That pot is Binance’s money, walled off from customer balances. The point of the cushion is to keep a busted futures position from being pushed onto other traders. What left the fund, Binance said, was extra above the minimum its risk rules demand, and the fund is still over that minimum. If the fund later drops under that minimum, Binance said it puts company money back in when required. Treasury cash is still paying for tokens the other two pools do not finish. Binance said it will restore SAFU to about $1 billion.
Binance has posted a fresh reserves cut on its reserves site, dated midnight UTC on 31 October. In that kind of proof, coins the venue holds are set beside what customers are owed. The long zero-knowledge file, which lets you test your own credit against the lineup without opening someone else’s account, needs roughly 40 to 50 hours of computing before it is done. Binance expects the file on Tuesday, 3 November, in UTC. A holder of any fully matched token can then look for at least one coin in custody per coin the account shows.
Binance reopened withdrawals on Sunday, 1 November, in phases. CNBC reported the restart, and Binance said on X that the first batch network opened in phase one was the bitcoin network, with Ethereum and BNB Smart Chain following. More networks come back as security checks finish.
