FBI links record $6.3 billion Binance crypto theft to North Korea

On 29 October 2026, a flash of activity on Binance’s trading platform turned into a record‑setting cyber‑heist that saw more than $6 billion in digital assets vanish in a matter of minutes. By 31 October the U.S. FBI announced that the attack was carried out by a North Korean state‑linked hacking unit known as TraderTraitor, bringing the theft into the realm of state‑sponsored cyber warfare. The revelation has rattled the cryptocurrency market, prompted a sweeping freeze of the stolen funds, and forced Binance to commit to covering the bulk of the losses.

The theft unfolded on Thursday evening, when attackers accessed Binance’s system and moved roughly $6.3 billion out of wallets on ten blockchains. The operation, which lasted about 20 minutes, was initially blamed on a compromised engineer’s laptop, an explanation that Binance later expanded to include “additional points of breach.”

Media additions

Binance hack — FBI Blames North Korea for $6B Crypto Heist

Binance’s response has been swift. In a post on X (formerly Twitter) dated Saturday 31 October, co‑CEO Richard Teng announced that the exchange had “replaced 90 % of the stolen assets” using company reserves, including its $1 billion Secure Asset Fund for Users (SAFU) and a portion of its Futures Insurance Fund. Teng added that the remaining 10 % comprised less‑liquid tokens and that Binance was “committed to covering the remaining 10 %” to ensure users would not bear losses. Binance also said it would resume withdrawals on Sunday 1 November.

The FBI’s statement, released on Saturday 31 October, identified TraderTraitor as the culprit. The agency, working with the U.S. Secret Service and the Internal Revenue Service’s criminal investigation division, noted that the hackers moved the stolen cryptocurrency primarily into Ethereum, before potentially laundering the funds through decentralized finance (DeFi) platforms and instant swap services. The attribution marks the first formal confirmation that a North Korean unit carried out the attack, following earlier speculation by analysts and crypto‑analytics firms such as TRM Labs and Chainalysis.

The attack is the largest recorded cryptocurrency theft, surpassing the $1.5 billion Bybit hack in 2025 and the $620 million theft attributed to North Korea in 2022. TraderTraitor, also known as Lazarus Group, has a history of high‑profile cyber‑attacks, including the 2014 Sony Pictures breach. The FBI’s attribution underscores the growing role of state sponsors in crypto theft and the potential use of proceeds to fund illicit programmes.

President Donald Trump, who had publicly questioned the FBI’s assessment, said on a Halloween party at Mar‑a‑Lago that investigators were “learning about it” and that “we don’t know if it’s North Korea.” His comments came amid speculation about a possible diplomatic engagement between Washington and Pyongyang, a subject that has resurfaced in recent policy discussions. The FBI’s findings could influence any future talks, as the theft highlights North Korea’s continued reliance on cyber‑crime to circumvent sanctions.

Meanwhile, the market’s reaction was swift: Bitcoin fell 5% after the news of the hack, while Ethereum dropped nearly 6% and BNB, native to Binance, tumbled nearly 10%.

The U.S. Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned the Lazarus Group, and the FBI is urging exchanges, DeFi projects, and blockchain analytics firms to block transactions with addresses linked to TraderTraitor. The move aims to prevent the laundering of stolen funds and to disrupt the attackers’ ability to move the assets into the wider financial system.

What to Watch Next

• Binance’s follow‑up disclosure on 1 November regarding the status of the remaining 10 % of stolen tokens.
• Any official statement from the North Korean government denying involvement.
• Potential diplomatic talks between the U.S. And Pyongyang, which could be influenced by the cyber‑attack’s attribution.
• Further actions by the FBI and partner agencies to block and seize the stolen assets.

As the theft’s aftermath unfolds, the cryptocurrency industry faces a stark reminder of the vulnerabilities inherent in digital asset exchanges. The FBI’s confirmation that a state‑sponsored group was responsible adds a new layer of geopolitical risk to crypto operations worldwide, and the industry’s response—both technical and regulatory—will shape the future of digital finance.