FBI seizes $1.2 billion in crypto stolen from Binance in record $6.3 billion heist - The Times of India

The US Federal Bureau of Investigation (FBI) announced Thursday that American authorities had seized or obtained court authorization to seize more than $1.2 billion worth of cryptocurrency stolen last month from Binance, the world's largest cryptocurrency exchange. This recovery represents a significant breakthrough in tracking down funds from what is considered the biggest cryptocurrency heist in history.

The October theft involved approximately $6.3 billion in digital assets, which the FBI has attributed to TraderTraitor, a North Korean hacking group. US authorities and private-sector partners have collectively frozen more than $2.7 billion of the stolen cryptocurrency to date.

The Binance Breach

The incident occurred on October 29 when hackers drained approximately $6.3 billion worth of cryptocurrency from Binance wallets used to process transactions. The bulk of the theft was executed in around 20 minutes, according to blockchain records analyzed by cybersecurity firms. The precise method used to breach Binance's systems remains unclear, though the exchange initially suspected a compromised laptop before identifying additional points of vulnerability.

Blockchain analytics firm TRM Labs revealed that the attackers had compromised Binance's transaction-signing infrastructure, which authorizes transfers and enables funds to be moved out of wallets. Rather than stealing actual wallet keys, the hackers gained control over the system that authorized the release of funds. Binance's investigation continues, with co-CEO Richard Teng assuring users that losses would be covered through the company's Secure Asset Fund for Users and its own resources.

Tracking the Stolen Funds

After draining the wallets, the attackers attempted to move the cryptocurrency across different wallets and blockchains to avoid detection. A significant portion of the stolen assets was held in stablecoins like Tether's USDT and Circle's USDC, which can be frozen remotely by their issuers—making it possible for companies to block suspicious transactions when alerted by investigators.

Chainalysis reported that the attackers attempted to convert hundreds of millions of dollars in stablecoins into Ethereum to move assets beyond the reach of issuers. The firm tracked $325 million in stablecoin conversions into approximately $285 million worth of Ethereum over nearly 20 minutes. However, cryptocurrency companies, investigators and law enforcement agencies began freezing funds within hours of the attack, with the first freezes occurring at around 5:14 pm Eastern Time on October 29.

North Korean Connection

The FBI has attributed the Binance theft to TraderTraitor, a North Korean state-backed hacking group accused of targeting cryptocurrency exchanges, decentralized finance platforms and investors to generate funds for the regime. Chainalysis strengthened this link after observing funds stolen from Binance being mixed with cryptocurrency taken in a separate attack on exchange Bitget, which had also been attributed to North Korean hackers.

North Korea has repeatedly been accused by US authorities of carrying out cryptocurrency thefts to generate revenue for its government and circumvent international sanctions. The funds are alleged to help finance the country's weapons programs, including its prohibited nuclear and ballistic missile activities. The latest seizure represents Washington's ongoing efforts to disrupt Pyongyang's alleged use of cybercrime to generate funds for its government and illicit weapons program.