Malicious actors from North Korea were observed laundering the stolen assets by converting them into ethereum, the FBI said, adding that it expects “further laundering stages” for the stolen digital assets.
An elite group of North Korean hackers, who go by the name of the TraderTraitor group, emerged as the prime suspects early on.
Researchers say TraderTraitor targets developers and IT staff at financial institutions through malware or phony job offers, tricking candidates into downloading malicious software during fake job interviews, giving the hackers access to login credentials and other sensitive data.
TRM Labs, a blockchain intelligence firm that surveils the industry, said the elite hacking unit were able to carry out the record-breaking heist in just 20 minutes.
Binance said it has recovered around 90 per cent of the funds lost after hackers stole nearly $6.3bn (£4.7bn) of assets.
Read more: Crypto firm Binance says it has replenished 90% of losses after $6.3bn hack
Read more: ‘Largest cryptocurrency heist in history’ sees $6.3bn stolen by elite North Korean hackers
The outstanding 10% consists of tokens that are less liquid, which means they may take longer to source in the required amounts, it said in a statement.
The company said in a statement today: “Binance will absorb the financial impact of these stolen funds, not our users.”
The hack is believed to be the largest in history, eclipsing the record of a $1.5bn heist on the Bybit exchange in 2025.
Initial investigations indicated that hackers accessed Binance’s systems via a compromised laptop, which allowed access to unauthorised withdrawals
Crypto prices fell on Friday, while Binance — the world’s biggest crypto exchange — sought to reassure customers that their funds were safe.
After the hack, the exchange stopped allowing customers to withdraw their funds, but it said on Saturday it was still on track to re-open withdrawals on Sunday.
Binance said it has set aside around $6.34 billion of company funds internally to cover the losses.
