The FBI said in an alert published on Saturday that North Korea was responsible for the theft of more than $6 billion in virtual assets from crypto exchange Binance on or about October 29. According to BleepingComputer, the agency attributed the attack to TraderTraitor, a group also tracked as Lazarus Group and APT38. Blockchain intelligence firms TRM Labs and Chainalysis had already linked the theft to the group.
According to the updated figures, the attackers stole about $6.36 billion across ten blockchains, with most of the funds moved within 20 minutes. Early reports, which we covered on October 30, put the figure at about $5.6 billion. Binance linked the breach to a compromised DevOps engineer's laptop, which gave the attackers access to a service container from which they submitted unauthorized withdrawals.
The FBI expects the group to convert the assets mainly into Ethereum and launder them through DeFi platforms and instant swap services. Together with the Secret Service and IRS Criminal Investigation, the agency published 628 crypto addresses tied to the theft and asked exchanges, blockchain operators and virtual asset service providers to block transactions linked to them.