FBI blames North Korea for $6 billion Binance crypto hack
Note: AI technology was used to generate this article’s audio.
The Federal Bureau of Investigation has formally attributed the theft of more than $6 billion in virtual assets from the cryptocurrency exchange Binance to actors linked to North Korea.
The incident, which occurred on Thursday, ranks as the largest cryptocurrency heist on record.
The FBI refers to the responsible North Korean cyber activity as “TraderTraitor.”
In an official alert released on Saturday, the FBI stated that North Korea was responsible for the theft.
Working with partners at the US Secret Service and IRS Criminal Investigation, the bureau observed TraderTraitor actors converting the stolen assets primarily into Ethereum.
Officials expect the funds will undergo further laundering stages through decentralized finance platforms and instant swap services.
Blockchain intelligence firms had earlier linked the attack to the same group with high confidence.
TRM Labs estimated that approximately $6.36 billion was transferred out of Binance wallets across multiple blockchains, the majority in roughly 20 minutes.
The firm noted similarities to prior incidents attributed to TraderTraitor, including the $1.5 billion Bybit theft in February 2025 that the FBI had previously blamed on the group.
Binance reported that its hot wallets were compromised, with an initial investigation pointing to a compromised engineer’s laptop that enabled unauthorized withdrawal transactions.
The exchange suspended withdrawals while working with law enforcement and industry partners.
Roughly $3 billion in stolen assets was frozen on-chain through coordinated efforts.
Binance has committed to covering all losses with company funds so that users are not affected.
Co-CEO Richard Teng stated: “We are committed to covering all hacked losses through our company funds. Your assets are safe.”
The exchange set aside more than $6.34 billion, including $5 billion already held in the exact token assets impacted, and by October 31 reported that it had replenished 90 percent of the stolen assets.
The FBI, US Secret Service, and IRS-CI have urged private-sector entities—including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers—to block transactions involving or derived from addresses used by the TraderTraitor actors.
A list of associated Ethereum addresses was published in the FBI alert.
North Korean state-linked cyber groups have repeatedly targeted cryptocurrency platforms in recent years, with proceeds assessed by US officials as helping fund weapons programs.
Binance continues recovery and security reviews, with plans to resume withdrawals and provide updated proof-of-reserves transparency.
Investigations into the full scope of the theft and laundering activity remain ongoing.
