FBI Attributes Record $6.3 Billion Binance Cryptocurrency Theft to North Korea

The United States Federal Bureau of Investigation stated on October 31, 2026, that North Korea was responsible for the theft of more than $6 billion in virtual assets from the cryptocurrency exchange Binance on or about October 29. Blockchain analytics firms TRM Labs and Chainalysis had already attributed the attack to TraderTraitor, a North Korean unit linked to the broader Lazarus Group, with high confidence based on on-chain and off-chain indicators. The haul ranks as the largest cryptocurrency theft on record, more than four times the $1.5 billion taken from Bybit in February 2025.

TRM Labs estimated that approximately $6.36 billion left Binance wallets across ten blockchains, most of it in about 20 minutes beginning around 4:05 p.m. Eastern Time. Chainalysis placed the total near $6.4 billion. Investigators observed funds from the Binance theft commingling in real time with proceeds from a prior Bitget exploit also linked to North Korean actors. Binance later reported that it had reserved more than $6.34 billion of company funds to cover user losses, with roughly $3 billion already frozen on-chain by issuers and partners including Tether, Circle, and others. Withdrawals resumed in phases after an initial suspension.

Binance co-CEO Richard Teng indicated that the attackers appeared to have compromised one engineer’s laptop and other points of entry, then deployed a self-destruct mechanism that destroyed tooling and traces. The speed of the transfers suggested heavy automation. TRM Labs noted preparation activity beginning only 36 hours before the drain. The group exploited techniques including a recent Ethereum upgrade, EIP-7702, to automate authorizations from a hot wallet used for customer withdrawals. One transaction alone moved more than 167,000 ETH and additional tokens.

North Korean state-linked hackers have stolen at least $6.75 billion in cryptocurrency through the end of 2025 according to earlier Chainalysis figures, and some estimates now place the cumulative total higher. Proceeds help fund the regime’s weapons programs. TraderTraitor was previously identified in a 2022 joint advisory from the FBI, CISA, and the Treasury Department as a group that targets software developers and IT staff at cryptocurrency firms with malicious software and social-engineering tactics. The same operation was blamed for the Bybit theft.

Binance stated that deposits were unaffected and that it would fully cover the financial impact on users. About $2.4 billion or more remains outside issuer freezes, held largely in Ethereum and Bitcoin addresses, according to tracking firms. Elliptic’s chief scientist noted that roughly $3.24 billion remained in addresses linked to the hack shortly after the event. Further laundering through bridges, swap services, and over-the-counter brokers is expected. The FBI released a list of addresses and continues to work with public and private partners on recovery and investigation.

The scale and speed of the operation highlight the maturation of North Korea’s cyber capabilities as a state revenue stream. Earlier incidents such as the 2014 Sony Pictures attack established the Lazarus Group’s reach; subsequent financial thefts have grown in sophistication and volume. Analysts note that the Binance case combined familiar social-engineering entry points with rapid automated extraction, raising questions about the role of tooling and possible AI-assisted elements in future attacks. Recovery efforts continue, but a substantial portion of the stolen assets has already moved beyond immediate freeze points.