The FBI said on Saturday that North Korea was behind the cyberattack on cryptocurrency exchange Binance, in which assets worth $6.3 billion were stolen. Experts describe it as the largest cryptocurrency theft on record, more than four times the size of the previous record, the $1.5 billion hack of the Bybit exchange in February 2025.
FBI attribution
According to the FBI, the large-scale attack was carried out by hackers from TraderTraitor, a group backed by the North Korean regime. The agency said it had observed members of the group attempting to convert stolen funds into Ethereum, and that it expects further laundering activity to follow.
The FBI called on virtual asset service providers to block transactions linked to the laundering operation, and published the suspected digital addresses to watch for.
Blockchain analytics firms had already pointed to North Korea before the FBI’s statement. TRM Labs attributed the attack to TraderTraitor “with high confidence”, and Chainalysis chief executive Jonathan Levin also said the group was the likely culprit. TRM estimated the losses at around $6.36 billion across ten blockchains, and said most of the funds left Binance’s wallets in about 20 minutes.
The FBI previously attributed the 2025 Bybit theft to the same North Korean group. According to Chainalysis, hackers linked to the North Korean government stole $1.34 billion in cryptocurrency across 47 incidents in 2024.
How the breach happened
Binance disclosed the breach on Friday, 30 October. According to the platform, a preliminary investigation showed the breach may have started with a compromised laptop belonging to one of its engineers. This gave the hackers access to one of its systems and allowed them to make unauthorised withdrawals. A later review found additional points of breach.
Binance said its own hot wallet was affected, while most user assets are held in cold storage. Co-chief executive Richard Teng said the attackers used a “self-destruct mechanism” that is complicating the investigation, and that the attack was not carried out by a single person.
On Friday, US President Donald Trump said US officials were investigating the hack. Asked whether North Korea was involved, he said: “We’re looking at that.”
90% of stolen assets replaced
Binance announced that it has replaced 90% of the stolen assets, using company money to buy new tokens. The remaining 10% consists of less liquid digital assets (tokens), which take longer to acquire.
“We have replaced 90% of the stolen assets and are committed to covering the remaining 10%. Our users will not bear the financial burden of this incident,” Richard Teng said.
Binance said it has set aside around $6.34 billion of company funds to cover the losses. Working with other exchanges and blockchain partners, it has also been able to freeze about $3 billion of the stolen assets.
Withdrawals to resume
After the hack, Binance suspended customer withdrawals, though deposits were not affected. It said on Saturday it was on track to reopen withdrawals on Sunday. The exchange also said it had taken a new snapshot of the assets held on its platform as part of its proof-of-reserves process.
Cryptocurrency prices fell on Friday as Binance, which runs the world’s largest crypto exchange, sought to reassure customers that their funds were safe.
Source: ANA-MPA, with information from AP, Reuters, NBC News and Al Jazeera
