FBI Identifies Culprits

The US agency blamed the operation specifically on a group called TraderTraitor, the same group blamed for a $1.5bn theft from the Bybit platform in February last year. According to the statement, the assets are expected to be ‘further laundered’ in stages. The FBI called on virtual asset service providers to block transactions being used in the latest laundering operation, providing the suspected digital addresses to watch for.

Binance Responds to the Theft

In a separate statement on Saturday, Binance said it has replaced 90 percent of the amount stolen by using company money to buy new tokens. The remaining 10 percent consists of less liquid tokens, meaning they may take longer to buy, it added. ‘We will continue to buy the remaining relevant token assets… until the covered amount reaches 100 [percent] for all tokens. Binance will absorb the financial impact of these stolen funds, not our users,’ the company said on X.

The money spent re-buying tokens came from a $1bn Secure Asset Fund for Users (SAFU), a Bitcoin reserve fund Binance holds to protect customers in the event of security breaches, as well as some of its Futures Insurance Fund and the company’s corporate treasury. Crypto prices fell on Friday, as Binance, which runs the world’s largest crypto exchange, sought to reassure customers their funds were safe.

Timeline and Details of the Attack

Binance co-CEO Richard Teng said on Friday that the breach was a ‘complex attack’ involving a compromised laptop and malicious software designed to delete evidence of its activity, making it hard to trace and investigate. After the hack, the exchange stopped allowing customers to withdraw their funds. Binance said later on Saturday that it was on track to reopen withdrawals on Sunday.

Binance also announced the publication of a new proof-of-reserves snapshot, allowing users to independently verify that their assets were backed at a minimum 1:1 ratio.

The FBI said the theft was tied to ‘malicious cyber activity’ by an entity known as TraderTraitor, the same actors behind a $1.5 billion Bybit hack last year. The agency said it had ‘observed TraderTraitor actors converting stolen assets’ primarily into a cryptocurrency called ethereum. ‘It is expected these assets will then be further laundered by converting them using DeFi [decentralized finance] and instant swap services as they prepare them for further laundering stages,’ it added.