The US Federal Bureau of Investigation (FBI) said Thursday that US authorities had seized or secured court authorisation to seize more than $1.2 billion worth of cryptocurrency stolen last month from Binance, the world’s largest cryptocurrency exchange. The recovery forms part of a wider effort by US authorities and private-sector companies to track down funds taken in what is regarded as the biggest cryptocurrency heist in history.The October theft involved approximately $6.3 billion in digital assets and has been attributed by the FBI to TraderTraitor, a North Korean hacking group. The US government and private-sector partners have so far managed to freeze more than $2.7 billion of the stolen cryptocurrency. The Justice Department said it had obtained court authorisation to seize or restrain more than $1.2 billion of those assets, reported AP.The latest action is part of Washington’s efforts to disrupt North Korea’s alleged use of cybercrime to generate funds for its government and illicit weapons programme. US authorities have repeatedly accused Pyongyang of using sophisticated cyberattacks to steal digital assets and evade international sanctions.
How did the $6.3 billion Binance heist happen?
The incident took place on October 29, when hackers drained approximately $6.3 billion worth of cryptocurrency from Binance wallets used to process transactions. The bulk of the theft unfolded in around 20 minutes, according to blockchain records analysed by cybersecurity firms.The precise method used to breach Binance’s systems remains unclear. The exchange initially suspected that a laptop had been compromised but later said its investigation had uncovered additional points of breach.Blockchain analytics firm TRM Labs said the attackers had compromised Binance’s transaction-signing infrastructure, which authorises transfers and allows funds to be moved out of wallets. In simple terms, the hackers may not have needed to steal the actual wallet keys but instead gained control over the system that authorised the release of funds.Binance had said its investigation was continuing, while its co-CEO Richard Teng assured users that losses would be covered through the company’s Secure Asset Fund for Users and its own resources.
How were the stolen funds tracked and frozen?
After draining the wallets, the attackers attempted to move the cryptocurrency across different wallets and blockchains to avoid detection and prevent the funds from being frozen.A significant portion of the stolen assets was held in stablecoins such as Tether’s USDT and Circle’s USDC. Unlike decentralised cryptocurrencies such as Bitcoin and Ethereum, stablecoins can be frozen remotely by their issuers, making it possible for companies to block suspicious transactions when alerted by investigators.Blockchain analytics firm Chainalysis said the attackers attempted to convert hundreds of millions of dollars in stablecoins into Ethereum to move the assets beyond the reach of issuers. The firm tracked $325 million in stablecoin conversions into approximately $285 million worth of Ethereum over nearly 20 minutes.However, cryptocurrency companies, investigators and law enforcement agencies began freezing funds within hours of the attack. Chainalysis said the first freezes began at around 5:14 pm Eastern Time on October 29.The US government and private-sector partners have since frozen more than $2.7 billion worth of the stolen assets. The latest court authorisation covers more than $1.2 billion. Such cases generally involve forfeiture proceedings, in which the government files a claim before a judge determines who has a legitimate right to the recovered assets.The FBI has attributed the Binance theft to TraderTraitor, a North Korean state-backed hacking group accused of targeting cryptocurrency exchanges, decentralised finance platforms and investors to generate funds for the regime.Blockchain analytics firm Chainalysis said its investigators strengthened the link after observing funds stolen from Binance being mixed with cryptocurrency taken in a separate attack on exchange Bitget, which had also been attributed to North Korean hackers.North Korea has repeatedly been accused by US authorities of carrying out cryptocurrency thefts to generate revenue for its government and circumvent international sanctions. The funds are alleged to help finance the country’s weapons programmes, including its prohibited nuclear and ballistic missile activities.
