FBI blames North Korea for record hack

What happened

On Saturday 31 October the FBI said North Korean hackers were behind the theft of about $6.3 billion from the world's largest crypto exchange two days earlier, the biggest crypto hack on record. According to the Associated Press, the bureau linked the attack to a group it calls TraderTraitor, the group AP says was also behind a $1.5 billion theft from another exchange last year. Searches for North Korea ("Coreea de Nord") and money laundering trended in Romania as the news spread, and "crypto hack" kept rising in several countries.

How the stolen coins are moving

The FBI found that the group was converting the stolen assets mainly into ether, and it expects the hackers to use decentralised finance (DeFi) and fast swap services next, AP reported. The bureau asked exchanges, blockchain analytics firms and others to block transactions linked to a list of addresses. Ari Redbord of TRM Labs told AP the hackers would probably split the funds and launder them through smaller platforms, a process that could take months.

Withdrawals reopen, money flows out

The exchange restarted withdrawals in phases from 06:00 UTC on Sunday 1 November. By its own figures, it processed $4.65 billion of withdrawals and $1.01 billion of deposits by 15:30 UTC, a net outflow of about $3.64 billion, CNBC reported. That is about 2.1% of the $171 billion in assets shown in its proof-of-reserves data from 28 October. The Block reported that by late Sunday morning, US time, withdrawals were still suspended for 531 of 552 listed coins, with bitcoin and ether among those partly restored.

Who covers the losses

The exchange says it has now covered about 95% of the affected amount, up from 90% in its previous update, and will absorb the cost instead of passing losses on to users, according to CNBC. The rest is in less liquid tokens that take longer to source. Circle, working with law enforcement, has frozen more than $1.1 billion in USDC linked to the incident, up from the more than $800 million its chief executive cited on Friday. For anyone asking what a stablecoin is, this is one practical point: the issuer of a token such as USDC can freeze it, which is why issuer controls keep coming up in this case.

Market reaction

US-listed spot bitcoin ETFs had net outflows of $643.3 million on Friday 30 October, the first trading day after the hack and the largest one-day outflow since 25 June, CoinDesk reported, citing SoSoValue data. CoinDesk presented the hack as one factor among others, alongside signs of weaker demand in the US. Before Friday the funds had net inflows of just over $1 billion for the year, and the outflow erased about 64% of that.

What to watch next

An updated proof-of-reserves report, based on a 31 October snapshot, was expected on Monday, The Block reported. Watch whether the remaining coins reopen for withdrawal, how much more of the stolen money is frozen, and whether the FBI's address list slows the laundering. For readers following crypto news, the case is also a test of how quickly issuers, analytics firms and exchanges can act together.

What it means for Odix Pay users

The hack is another reminder that keys kept online carry risk. If you hold coins yourself in a crypto wallet, the Odix hardware wallet keeps your private keys offline. If you use stablecoins, you can top up your Odix Pay account with USDT or USDC through our licensed partner. For the basics, read our guide What are stablecoins? USDT and USDC explained. Odix Pay is not a crypto wallet, does not provide any crypto custody service, and does not operate as a crypto buy/sell, Bitcoin/BTC or crypto investment platform. Crypto prices can go down as well as up. Availability depends on your country, and fees are shown in the app.