0
A Bitcoin logo is displayed on a smartphone screen in a photograph taken in Mulhouse, eastern France, on Feb. 11, 2025 (local time). Bitcoin prices plunged on Oct. 29 after multiple sources reported a massive hack of cryptocurrency exchange Binance. / AFP-Yonhap

[Article summary]

1. Binance said on Nov. 1 that it had begun gradually resuming withdrawals and had replenished 95% of the stolen assets using its own funds.

2. On Oct. 31, the Federal Bureau of Investigation (FBI) officially identified the North Korean hacking group TraderTraitor as responsible for the $6.3 billion theft.

3. The 18,270 bitcoins stolen by the hackers exceed Tesla's holdings by 59%, while their value is approximately three times North Korea's annual merchandise exports.

4. Japan's GMO Internet Group also reported to the government that a North Korea-linked group may have been involved in a leak of customer information.

Binance, the world's largest cryptocurrency exchange, said on Nov. 1 (local time) that it had begun gradually resuming withdrawal services and had replenished 95% of the stolen assets using its own funds following a record $6.3 billion (8.4155 trillion won) hack.

The FBI officially identified the North Korean hacking group TraderTraitor as responsible for the attack the previous day. The 18,270 bitcoins stolen by North Korean hackers exceed the holdings of U.S. electric vehicle maker Tesla by 59%, while their value is approximately three times North Korea's annual merchandise exports.

Binance resumes withdrawals, replenishes 95% of losses as net outflows reach $3.6 billion

Binance initially resumed withdrawals of 15 tokens in high demand among customers, including Bitcoin, Ethereum, Tether (USDT), USD Coin (USDC) and Dogecoin. It subsequently expanded withdrawals to 15 blockchain networks, including Ethereum, BNB Smart Chain, XRP and Base, Reuters reported.

Binance announced that net fund outflows stood at $3.64 billion (4.8623 trillion won) as of 3:30 p.m. Coordinated Universal Time (UTC) on Nov. 1 (12:30 a.m. on Nov. 2, Korea time). This represented approximately 2.1% of its total assets under custody. However, some withdrawals also included transfers between Binance's own wallets.

The company said the initial surge in withdrawals was gradually stabilizing and that deposits remained at a substantial level. As of Oct. 28, assets under custody totaled $171 billion (228.4218 trillion won), while the exchange had 335 million registered users worldwide.

Binance said it had replenished 95% of the stolen tokens using company funds, up 5 percentage points from the 90% announced the previous day. The remaining 5% consists of less-liquid assets that may take longer to purchase.

The replenishment was funded through part of the $1 billion (1.3358 trillion won) Secure Asset Fund for Users (SAFU), the futures insurance fund and corporate reserves. Binance co-CEO Yi He said the company would use half of the SAFU fund, and the company plans to replenish the fund.

Binance emphasized that it would not pass the losses from the hack on to customers. The company announced that it had frozen or recovered approximately $3 billion (4.0074 trillion won) in stolen assets through cooperation with other exchanges, analytics firms and law enforcement agencies.

However, frozen assets are not the same as assets actually returned, and the specific amount recovered has not been confirmed.

Binance plans to release updated Proof of Reserves data on Nov. 2.

		0
North Korea conducted a live-fire exercise involving its ultra-precision 600-millimeter large-caliber multiple rocket launchers, which it has named "Sniper," the Korean Central News Agency (KCNA) reported on Oct. 30. The exercise took place the previous day, Oct. 29, and was observed by North Korean leader Kim Jong-un, his daughter Ju-ae and his wife Ri Sol-ju, among others. / KCNA, Yonhap

FBI officially identifies North Korea's TraderTraitor as culprit

In a statement the previous day, the Federal Bureau of Investigation (FBI) said North Korea was responsible for the theft of more than $6 billion (8.0148 trillion won) in virtual assets from Binance on or around Oct. 29 and identified TraderTraitor, a North Korean government-backed hacking group, as the perpetrator. Following assessments by private analytics firms attributing the attack to North Korea, U.S. investigators officially announced the same conclusion.

The FBI said it had observed members of TraderTraitor converting stolen assets into Ethereum. It also expected them to attempt further money laundering through decentralized finance (DeFi) and instant swap services. The FBI urged private cryptocurrency companies to block transactions originating from or linked to wallet addresses used by the hackers. The U.S. Secret Service and the Internal Revenue Service's Criminal Investigation division (IRS-CI) also cooperated in tracking and freezing the stolen assets.

However, U.S. President Donald Trump withheld judgment even after the FBI announcement. Speaking to reporters in Florida the previous day, he said, "We don't know if it's North Korea," adding, "If it's North Korea, we'll talk to North Korea." North Korea has denied allegations for years that it has used state-linked cyber groups for espionage, financial theft and fundraising, Reuters reported.

Binance founder Changpeng Zhao expressed his gratitude to U.S. investigators in a post on X citing the FBI statement, saying, "One tweet cannot express enough of our gratitude."

Hackers steal $6 billion in 20 minutes through repeated withdrawals from exchange wallets

Hackers are believed to have stolen more than $6 billion in virtual assets in approximately 20 minutes, starting around 4:20 p.m. on Oct. 29 (U.S. Eastern Time; 5:20 a.m. on Oct. 30, Korea time). Blockchain analytics firms TRM Labs and Chainalysis assessed that the attack methods resembled those used in previous major hacks linked to North Korea. The hackers repeatedly withdrew assets from blockchain wallets that continued to receive funds from the exchange.

Binance co-CEO Richard Teng explained that the attackers had used malicious software designed to erase traces of the intrusion. Binance's initial investigation found indications that a laptop belonging to a development and operations engineer had been compromised. Additional points of compromise were subsequently discovered, but the exact method of intrusion remains under investigation.

		0
Changpeng Zhao, founder of Binance, the world's largest cryptocurrency exchange, enters a federal courthouse in Seattle, Washington, on April 30, 2024 (local time). / AP-Yonhap

Hackers steal 18,270 bitcoins, 59% more than Tesla holds

According to cryptocurrency news outlets CoinDesk and Cointelegraph, hackers stole 18,270 bitcoins from Binance. At a price of $78,500 (104.86 million won) per bitcoin, the stolen assets are worth approximately $1.434 billion (1.9155 trillion won). This is about 59% more than Tesla's holdings of 11,509 bitcoins.

The amount is also 199 bitcoins more than the 18,071 held by Coinbase, the largest U.S. cryptocurrency exchange, for investment and operational purposes as of the end of September. The figure excludes assets Coinbase holds on behalf of customers. It is 442 bitcoins fewer than the 18,712 held by SpaceX, the space company led by Elon Musk.

The government of El Salvador, which adopted Bitcoin as legal tender in 2021, holds approximately 7,820 bitcoins. The stolen amount is 2.3 times that figure. However, the 18,270 bitcoins represent the amount stolen by the hackers and do not mean that the holdings have been confirmed as official Bitcoin reserves of the North Korean government.

Citing blockchain transaction records, CoinDesk reported that the hackers transferred the bitcoins from Binance's internet-connected hot wallet to a new address in 11 transactions. They then distributed the bitcoins across 19 addresses, with 17 of those addresses each receiving 1,000 bitcoins.

Blockchain analytics firm Bitquery estimated that the attackers controlled 525,201 ether as of Oct. 31. This exceeded the 495,362 ether held by The Ether Machine, which ranked third in corporate Ethereum holdings. The attackers directly stole 200,630 ether before increasing their holdings by exchanging other cryptocurrencies for Ethereum.

Changpeng Zhao said on X that the incident was the largest in terms of its U.S. dollar value, but not in terms of the number of bitcoins stolen. He cited the theft of approximately 650,000 bitcoins during the collapse of Mt. Gox in 2014 as a comparison. The stolen amount at the time exceeded 5% of all bitcoins in circulation, German business newspaper Handelsblatt reported.

Hackers steal bitcoins worth three times North Korea's annual exports

The value of the bitcoins stolen by the hackers far exceeds North Korea's annual merchandise exports. According to the Korea Trade-Investment Promotion Agency (KOTRA), North Korea's merchandise exports totaled $468.59 million (625.9 billion won) in 2025. The value of the bitcoins stolen in this attack is approximately three times North Korea's annual merchandise exports.

The estimated total losses of $6.3 billion, including Bitcoin, Ethereum and stablecoins, amount to approximately 24% of North Korea's estimated 2025 gross domestic product (GDP) of $26 billion (34.7308 trillion won). This is more than four times the $1.5 billion (2.0037 trillion won) stolen from cryptocurrency exchange Bybit in February 2025. The FBI also assessed that TraderTraitor was involved in the Bybit hack.

Cryptocurrency theft by North Korea-linked groups has continued for years. U.S. newspaper The Washington Post (WP) reported that TRM Labs estimated North Korean hackers had stolen $12.8 billion (17.0982 trillion won) in more than 100 incidents since 2017.

The amount of assets stolen in the latest Binance hack that have actually been converted into cash and their ultimate use remain unconfirmed. The FBI warned of possible further money laundering involving the stolen assets and urged private companies to block related transactions.

		0
Japanese information technology (IT) giant GMO Internet Group announced on Nov. 1 that it would offer a total of $1 million (133.58 billion won) to individuals providing information related to a customer data leak involving its foreign exchange margin trading (FX) service. / Screenshot from GMO Internet Group's website

Japan's GMO reports suspected North Korea-linked involvement in customer data leak to government

Suspicions of hacking by North Korea-linked groups have also emerged in Japan. Japanese IT giant GMO Internet Group reported to the government that it believed North Korea-linked hackers were highly likely to have been involved in a customer data leak affecting its foreign exchange margin trading (FX) service, Kyodo News reported on Nov. 1.

GMO Internet Group analyzed malicious software and traces of the attack left on its servers. Kyodo also examined a website where the hackers claimed responsibility for the attack, with assistance from security experts. Five Internet Protocol (IP) addresses that accessed the website shortly after it went online were found to match addresses previously used by North Korean hacking groups.

However, the rented server used by the website belonged to a U.S. company, and parts of the program used to collect visitor records contained Japanese text. Files posted on the website were created using Chinese-made software. The sender of an email received by an affected customer used a Russian-style name. Kyodo suggested that these traces linked to multiple countries may have been deliberately planted to disrupt the investigation.

The hackers claimed to have infiltrated 27,000 GMO servers and personal computers and stolen customer information, demanding $1 million (13.358 million won). However, the hackers' claims about the scale of the intrusion have not been independently verified.

GMO rejected the demand and instead offered a bounty of the same amount. The company plans to pay the reward to informants who provide information that helps identify the attackers and clarify the circumstances of the incident. It has not been confirmed whether the same group was involved in both the Binance and GMO incidents.

Masatoshi Kumagai, president of GMO Internet Group, is scheduled to hold a press conference on Nov. 2 to explain the circumstances of the incident and the facts established so far.

                                                                                                               Ha Man-joo