FBI Attributes Record $6.3 Billion Binance Hack to North Korea's TraderTraitor Group

The U.S. Federal Bureau of Investigation said on October 31 that North Korea was responsible for the theft of more than $6 billion in cryptocurrency from Binance on or about October 29. The agency identified the operation as TraderTraitor, the same group previously linked to the $1.5 billion Bybit hack in February 2025.

Binance, the largest cryptocurrency exchange by trading volume, halted withdrawals after the attack. Co-CEO Richard Teng stated that the company would absorb the losses with its own funds and that user deposits were not affected. The exchange said it had reserved roughly $6.34 billion for coverage, with about $5 billion already held in the specific tokens that were taken. Withdrawals began a phased resumption on November 1.

TRM Labs, a blockchain intelligence firm, attributed the theft to TraderTraitor with high confidence. It estimated the haul at about $6.36 billion moved across ten blockchains, most of it in roughly 20 minutes starting around 4:05 p.m. Eastern Time. Chainalysis reached a similar conclusion after observing funds from the Binance wallets commingling with assets from a prior Bitget exploit also linked to North Korean actors. Both firms noted the use of an Ethereum Improvement Proposal 7702 delegation that turned a Binance hot wallet into a controlled sweeper.

Stablecoin issuers and network operators froze significant amounts. Tether, Circle, Ripple, and World Liberty Financial locked about $2.67 billion. Arbitrum's Security Council froze additional ether and ARB tokens. Binance reported that partners had frozen roughly $3 billion in total. The remaining assets continue to move through mixers and cross-chain bridges, according to tracking firms.

North Korean state-linked groups have conducted large cryptocurrency thefts for years, using the proceeds to fund weapons programs, according to U.S. and South Korean assessments. The Binance incident is roughly four times the size of the Bybit theft and exceeds prior records by a wide margin. The speed of the withdrawal, concentrated in a 20-minute window, indicates prior access to signing infrastructure rather than a simple phishing attack.

Binance initially pointed to a compromised engineer laptop as the entry point. Later statements indicated additional breach points. The exchange has not publicly named a perpetrator. President Trump said on October 31 that it was not yet confirmed whether North Korea was involved, while the FBI statement the same day assigned responsibility to TraderTraitor.

Market reaction was immediate. Spot Bitcoin exchange-traded funds recorded outflows in the days after the announcement. Binance's own token and other major assets showed volatility, though prices stabilized as the coverage pledge became clear. The incident has renewed discussion of hot-wallet security and the concentration of assets on a small number of large exchanges.

Law enforcement and private firms continue to monitor the stolen funds. The FBI listed specific wallet addresses and urged exchanges and issuers to block transactions involving them. Recovery of the unfrozen portion will depend on tracing through decentralized finance protocols and over-the-counter desks.

For users, the practical effect is that Binance is covering the shortfall. The company said 90 percent of the losses had already been addressed by November 1. Full restoration of withdrawal functionality is expected to continue in stages to avoid further instability.

The scale of the theft underscores the revenue North Korean cyber units have extracted from the cryptocurrency sector. Prior U.S. indictments and sanctions have targeted individuals and front companies linked to Lazarus Group subunits. Whether additional designations follow this incident remains a matter for the Treasury Department and the State Department.