FBI Attributes Record $6.3 Billion Binance Crypto Theft to North Korea

The Federal Bureau of Investigation has formally attributed the theft of more than $6.3 billion in virtual assets from the cryptocurrency exchange Binance to North Korea. The attack occurred on or about 29 October and ranks as the largest publicly reported crypto heist.

In a statement released 31 October, the FBI, working with the U.S. Secret Service and IRS Criminal Investigation, identified the North Korean group TraderTraitor as responsible. The same group has been linked to a $1.5 billion theft from Bybit earlier. The bureau observed the attackers converting stolen assets primarily into Ethereum and listed more than 600 Ethereum addresses, 19 Bitcoin addresses, and one Solana address believed to hold or have held proceeds.

Binance said the intrusion may have begun with a compromised DevOps engineer's laptop and involved malicious software designed to erase evidence. The exchange suspended withdrawals temporarily and stated it would cover all user losses with company funds. By early November it reported that 90 percent of the stolen amount had been replaced through open-market purchases, with the remainder consisting of less liquid tokens still being acquired.

Blockchain analytics firms TRM Labs and Chainalysis had earlier linked the movement of funds to North Korean actors. Elliptic estimated the total at roughly $6.43 billion across multiple chains, with a portion frozen on-chain by issuers of stablecoins. The FBI has asked virtual asset service providers, DeFi platforms, and node operators to block transactions tied to the identified addresses to disrupt further laundering.

North Korean cyber units have used cryptocurrency theft for years as a source of hard currency to circumvent international sanctions. TraderTraitor has focused on virtual asset businesses. The scale of the Binance operation, completed in roughly 20 minutes across multiple blockchains, demonstrates both technical capability and operational speed.

Binance remains the largest cryptocurrency exchange by trading volume. Its decision to absorb the losses protects users in the short term but shifts the financial cost to the company. The incident also raises questions about the security of hot wallets and internal access controls at major platforms.

U.S. authorities have previously sanctioned North Korean cyber actors and sought to disrupt their laundering networks. The current advisory continues that approach by publishing specific addresses and urging industry cooperation. Whether the remaining unfrozen funds can be traced and recovered will depend on the speed of laundering through decentralized services.

The theft adds to a series of high-value North Korean crypto operations in 2025 and 2026. Combined proceeds from such campaigns have reached tens of billions of dollars in recent years according to private estimates, providing a material revenue stream for the regime. Binance has said it will continue purchasing replacement assets until user balances are fully restored.