North Korea Blamed for Record Binance Crypto Heist

The FBI has attributed the theft of a record $6.3 billion in virtual assets from cryptocurrency exchange Binance to North Korea. The agency said North Korean actors were laundering the stolen assets, primarily by converting them into Ethereum, and warned that the funds are expected to be moved through further laundering stages. It identified the group TraderTraitor, which was also blamed for a $1.5 billion theft from the Bybit platform in February of the previous year. The FBI urged virtual-asset service providers to block transactions connected to the operation and supplied digital addresses to monitor. Binance said it had replaced 90 percent of the stolen amount by using company funds to purchase new tokens. The remaining portion consists of less liquid tokens that could take longer to reacquire. The company said it would keep buying the relevant assets until it had replaced the full covered amount, and that it—not its users—would bear the financial impact. Funding came from Binance’s $1 billion Secure Asset Fund for Users, its Futures Insurance Fund, and corporate treasury. The incident unsettled markets: cryptocurrency prices fell on Friday as Binance sought to reassure customers. Co-CEO Richard Teng described the breach as a complex attack involving a compromised laptop and malware designed to erase evidence, complicating investigation and tracing. Binance temporarily halted customer withdrawals after the hack, then said it expected to reopen them on Sunday. It also published a new proof-of-reserves snapshot intended to let users verify that customer assets were backed at a minimum one-to-one ratio.

Blockchain intelligence firms and the FBI say North Korea’s TraderTraitor hacking unit was likely behind an attack that stole approximately $6.36 billion from Binance, the world’s largest cryptocurrency exchange. TRM Labs said the funds were moved from Binance wallets across ten blockchains, mostly within about 20 minutes. If confirmed, the incident would be the largest cryptocurrency theft on record. The FBI said the hackers were converting the stolen assets into Ethereum in preparation for further laundering, and linked the attack to TraderTraitor, which has also been associated with a $1.5 billion theft from the Bybit exchange in 2025. Binance said customer deposits were unaffected, but it suspended withdrawals and expected them to resume within a day or two. The company said it and its blockchain partners had frozen roughly $3 billion in affected assets and pledged to cover all customer losses. Binance’s initial investigation pointed to a potentially compromised laptop, while a later probe found additional points of breach. The exchange said it had found no evidence that wallet private keys had been leaked and promised to release more technical details after its investigation. The incident has raised questions about Binance’s security controls. NyxLab CEO Kok Tin Gan suggested that a single signature may have given the attacker lasting, full access to a hot wallet. Binance said its teams were working with law enforcement to identify those responsible. Analysts place TraderTraitor within the broader Lazarus Group, a North Korean hacking organization accused of targeting institutions in multiple sectors. U.S. officials and experts say North Korea uses cryptocurrency theft and other cybercrime to obtain foreign currency, support its economy, and fund its nuclear program amid international sanctions. The article also notes Binance founder Changpeng Zhao’s past guilty plea related to money-laundering controls, his departure as CEO, and his later pardon by President Trump.

The FBI says North Korea was responsible for stealing more than $6 billion in virtual assets from the cryptocurrency exchange Binance. The agency said the theft occurred on or about October 29, 2026, and was linked to malicious cyber activity by a group known as TraderTraitor. The FBI has associated the same actors with a $1.5 billion hack of Bybit the previous year. The theft reportedly unfolded within minutes and is believed to be the largest cryptocurrency heist in history. Stolen assets included bitcoin, ethereum, and stablecoins such as tether and USD Coin. News of the attack contributed to a fall in the prices of many major cryptocurrencies. According to the FBI, TraderTraitor actors have been converting stolen assets mainly into ethereum. The agency expects the funds to be moved through decentralized-finance and instant-swap services as part of further laundering efforts. It asked cryptocurrency exchanges, blockchain analytics firms, and other relevant organizations to block transactions associated with identified addresses, in an effort to prevent the proceeds from being laundered. Binance, the world’s largest crypto exchange by daily trading volume, said it would use more than $6.34 billion in company funds to buy tokens and replenish about 90% of the stolen assets. The remaining 10% comprised less-liquid tokens that could take longer to repurchase. Binance said it would fully cover the financial impact of the incident. The attack also comes amid growing concern that increasingly capable artificial-intelligence models could undermine cryptography and information-technology security protocols. The article reports the FBI’s attribution and Binance’s response, while presenting the possible security implications as a broader concern.

The article describes TraderTraitor, a North Korean hacking operation linked to the broader Lazarus Group, which US authorities blame for a reported US$6 billion theft from Binance on Oct 29. It presents the incident as the latest and largest in a series of cyberattacks attributed to North Korean actors, whose operations are believed to help finance the country’s weapons programme. TraderTraitor hackers are said to use social engineering, including fake recruitment offers, to persuade targets to download malware. The article recounts a 2024 attack on DMM Bitcoin: a hacker posing as a recruiter contacted an employee of a wallet software company on LinkedIn and sent a supposed pre-employment test containing malicious code. The compromised employee’s identity was then used to gain access to systems. The article places the group within North Korea’s broader cyber capabilities, which South Korean intelligence estimated included about 8,400 personnel in 2024. It also notes the Lazarus Group’s 2014 Sony Pictures hack, the 2016 theft from Bangladesh’s central bank, the 2017 WannaCry ransomware attack, and cryptocurrency thefts from the Ronin network, Atomic Wallet, Alphapo, CoinsPaid and Bybit. The Bybit theft, blamed on TraderTraitor in February 2025, involved about US$1.5 billion. According to a professor quoted in the article, stolen cryptocurrency is laundered through mixing services or private exchanges and converted into funds for military research, weapons-component procurement and the defence industry. A 2024 United Nations report said proceeds from North Korean cyberattacks reportedly helped fund weapons of mass destruction development. Analysts say cyber theft is attractive to Pyongyang because sanctions constrain conventional foreign-currency earnings, while digital assets can be stolen quickly, with relatively few resources, and moved outside conventional banking channels.

The FBI has attributed the theft of more than US$6 billion in cryptocurrency from Binance to North Korea, describing a cyberattack that experts consider the largest hack in cryptocurrency history and one of the biggest cyber incidents overall. In an Oct 31 statement, the FBI said North Korean “TraderTraitor” actors were converting the stolen assets primarily into Ethereum. Authorities expect the funds to be further laundered through decentralised finance (DeFi) and instant-swap services, making them harder to trace and recover. Binance has said it has covered about 90 per cent of the reported US$6.3 billion loss and plans to restore withdrawals by Nov 1. The exchange reiterated that it would absorb the full impact of the theft so customers would not lose money. The breach has unsettled the cryptocurrency industry as it seeks wider mainstream adoption. The article places the attack in the context of previous allegations against North Korean hackers, who have been linked by the FBI and cybersecurity experts to major cryptocurrency thefts. These include the US$1.5 billion Bybit attack in 2025 and a 2022 theft of about US$620 million. The FBI previously identified TraderTraitor as an elite North Korean hacking unit and blamed it for the Bybit incident. US President Donald Trump said the United States was investigating North Korea’s possible involvement. He commented on the risks of cryptocurrency theft, contrasting it with the familiar process of taking money out by cheque. The article also notes that Trump has recently raised the possibility of meeting North Korean leader Kim Jong Un in 2026, although he had earlier said he was unsure anyone was seeking such a meeting.

Binance says it has replaced about 90% of the tokens stolen in a record $6.3bn hack and expects to resume customer withdrawals on Sunday. The remaining 10% is made up of less-liquid tokens that may take longer to repurchase. Co-CEO Richard Teng said Binance would cover the outstanding amount, so users would not bear the financial loss. The company says it has set aside around $6.34bn to cover the incident, drawing on its $1bn Secure Asset Fund for Users, its Futures Insurance Fund and corporate treasury. The FBI has attributed the theft, which it says occurred around 29 October 2026, to TraderTraitor, a North Korea-affiliated group believed to be part of the Lazarus Group. The FBI said it had seen the attackers converting stolen assets into Ethereum and anticipated further laundering through decentralised finance and instant-swap services. It urged private-sector organizations to block transactions involving addresses used by the group. Teng described the breach as a complex attack involving a compromised laptop and malicious software intended to erase evidence, complicating tracing and investigation. The incident has renewed attention to North Korea’s ability to generate illicit revenue despite international sanctions imposed over its nuclear and missile programmes. The article also notes broader concerns that increasingly capable artificial intelligence could threaten cryptography and IT security. Following news of the hack, Bitcoin fell nearly 5%, Ethereum nearly 6% and Binance’s BNB token nearly 10%.

Binance, the world’s largest cryptocurrency exchange, said it would begin restoring withdrawals in phases after covering 95 per cent of the $6.3 billion in tokens stolen in a major cyberattack. The first phase was scheduled to start between 6am and 9am GMT on Sunday and include Bitcoin, ether, BNB, Solana, XRP, dogecoin and other digital assets. The remaining 5 per cent consists of less liquid tokens that Binance said could take longer to obtain in the required quantities. The exchange temporarily suspended withdrawals as a precaution while it contained the incident’s impact, assessed affected services and conducted security checks. Binance said deposits remained open and unaffected. It said it would absorb the financial impact of the stolen funds rather than pass losses to customers, and reiterated that user funds were safe. Withdrawals would resume progressively as security and readiness checks were completed. The FBI attributed the attack to TraderTraitor, a North Korean state-sponsored hacking unit. The agency said members of the group had converted stolen assets into ether and that it expected further laundering through related technology. The report places the incident in the context of recurring security and governance failures in the cryptocurrency industry. It recalls the 2014 collapse of Mt Gox after large-scale Bitcoin thefts and other technical and operational failures, and the 2022 collapse of FTX amid fraud and misuse of customer funds. FTX founder Sam Bankman-Fried was later sentenced to prison. The article also notes the FBI’s attribution of a separate $1.5 billion theft from Bybit to North Korea, underscoring ongoing security threats to digital-asset platforms.