FBI Attributes Record $6.3 Billion Binance Crypto Theft to North Korea

The US Federal Bureau of Investigation stated on Saturday, October 31, 2026, that North Korea was responsible for the theft of more than $6 billion in cryptocurrency from Binance, the world's largest crypto exchange.

In a cyber alert, the FBI said: "The FBI is releasing information advising the Democratic People's Republic of Korea was responsible for the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026." The agency identified the operation as TraderTraitor, the same name previously linked to North Korean crypto thefts, including a $1.5 billion heist from Bybit in February 2025.

The FBI, working with the US Secret Service and the Internal Revenue Service's Criminal Investigation division, observed the hackers converting stolen assets primarily into Ethereum. The agency expects further laundering stages and has urged virtual asset service providers to block transactions associated with the listed addresses.

Blockchain intelligence firm TRM Labs had earlier estimated the theft at $6.36 billion and attributed it to TraderTraitor. Binance confirmed the loss and said it has replaced 90 percent of the stolen amount by purchasing new tokens with company funds. The remaining 10 percent consists of less liquid tokens that will take longer to acquire. "Binance will absorb the financial impact of these stolen funds, not our users," the company stated on X. On Sunday it resumed bitcoin withdrawals after covering the bulk of the losses.

The scale exceeds previous single-exchange crypto thefts. North Korean state-linked groups have conducted a series of large exchange and bridge hacks over several years, using the proceeds to fund weapons programs according to US and UN assessments. TraderTraitor has focused on social-engineering and technical intrusion against exchange staff and infrastructure.

Binance's decision to make users whole from its own reserves limits immediate market disruption. Withdrawals paused briefly while the company assessed the breach. The remaining uncovered portion involves tokens with thinner markets, so full restitution may take additional time. No user funds were reported lost beyond the platform's coverage.

US authorities have not announced arrests. Attribution relies on technical indicators, known North Korean infrastructure, and patterns matching prior TraderTraitor activity. The FBI's public alert is intended to freeze assets still moving through exchanges and mixing services.

The incident adds another multibillion-dollar loss to the record of state-linked crypto crime. For Binance, the immediate priority is completing the token buybacks and restoring full withdrawal capacity. For investigators, the task is tracing the remaining Ethereum and any subsequent conversions before the funds leave the regulated system entirely.