It started with one laptop.
On or about October 29, someone got into a computer belonging to an engineer at Binance, the world's largest crypto exchange. From there, the attacker worked into the company's systems and started submitting withdrawals no one had approved. By the time it was over, about $6.3 billion was gone.
It's the biggest crypto theft ever recorded. The old record, the $1.5 billion Bybit hack last year, was less than a quarter of it.
The FBI says it knows who did it. The bureau traced the theft to TraderTraitor, a hacking unit working for the North Korean government and part of the network better known as the Lazarus Group. It's the same unit the FBI blamed for Bybit.
Agents also showed their work. The FBI, the Secret Service and IRS investigators put out a joint alert listing the crypto wallet addresses tied to the stolen money, and told every exchange and crypto business on the planet to block them. According to the alert, the hackers were already converting the loot into Ether and pushing it through services built to make money hard to trace.
Five days after the theft, North Korea responded through Kim Yo Jong, the sister of dictator Kim Jong Un. She called the FBI's findings "absurd rhetoric" and a political provocation meant to smear her country.
North Korea gave the same answer after Bybit. Kim Yo Jong's statement didn't explain the wallets, didn't say who else might have taken $6.3 billion, and didn't touch the evidence the FBI made public.
If you don't own a single bitcoin, this still matters to you. North Korea is one of the most heavily sanctioned countries on earth. It can't sell much to anyone, so it steals. The White House has said hacking and crypto theft pay for about half of Pyongyang's missile program. Every billion its hackers take helps pay for missiles built to carry a nuclear warhead to an American city.
Binance has said it will cover the loss itself. The exchange put up more than $6.34 billion of its own money and said customers wouldn't take the hit. A few days later it said about 95 percent of what was stolen had been replaced. It also published proof of its reserves so users could see the money was there.
That protects Binance's customers. The $6.3 billion is still out there, sitting in wallets the FBI is watching. Investigators are now in a race with North Korea's launderers to freeze it before it's turned into cash Pyongyang can spend.
Kim Yo Jong says none of it happened. The FBI's list of wallet addresses is public, and the transactions are on a ledger anyone can look up.