The FBI has publicly confirmed that North Korean actors were responsible for the $6.3 billion theft from Binance. In the days following the attribution, 19 wallets that hold a total of 18,270 stolen bitcoins have received a series of sub‑dollar payments, each accompanied by a pleading or promotional message. At the same time, THORChain node operators have temporarily halted swaps involving assets on ten blockchain networks, a move that aims to slow the hackers’ ability to move the stolen funds.
What happened
According to a statement released on November 2, the FBI identified North Korean hackers as the perpetrators behind the massive Binance breach. The same day, CoinDesk reported that the 19 wallets containing the stolen BTC have not received any substantial inflow since Thursday; instead, each wallet recorded tiny payments worth less than one US dollar, each paired with a message ranging from desperate pleas for assistance to attempts at token promotion.
Cointelegraph noted that THORChain, a cross‑chain liquidity protocol, responded by pausing swap functionality for assets on ten networks, including Bitcoin, Ethereum, Solana and Tron. The pause is intended to limit the hackers’ capacity to quickly convert or route the stolen coins across multiple chains.
Why it matters for traders
- Liquidity risk: The THORChain suspension reduces immediate cross‑chain liquidity, potentially affecting price dynamics for the involved assets as traders seek alternative routes.
- Tracking challenges: The sub‑dollar messages indicate that the hacker is receiving attention from a broad audience, but the lack of significant inflows suggests limited success in laundering the stolen BTC so far.
- Regulatory focus: The FBI’s attribution reinforces the likelihood of increased scrutiny on cross‑border crypto transactions, especially those involving high‑value hacks.
What to watch next
- Whether THORChain will lift the swap pause and under what conditions, as the protocol balances security with market demand.
- Any further communications from the 19 wallets, which could signal attempts to move larger amounts or coordinate with other platforms.
- Potential actions by other DeFi services to block or monitor addresses linked to the Binance hack, following the FBI’s call for coordinated defense.
- Developments in law‑enforcement cooperation that might lead to asset recovery or additional indictments against the alleged North Korean actors.
Sources
- FBI says North Korean hackers are behind the theft of $6.3B from Binance (NPR)
- Strangers are begging the Binance hacker for bitcoin, one ‘help me bro’ at a time (coindesk.com)
- THORChain halts swaps after block reorg bug, slowing Binance hackers (cointelegraph.com)
This is a developing story and will be updated as new information is confirmed. For information only, not financial advice. How we report.
