FBI Blames North Korea for Record $6.3 Billion Binance Heist as Withdrawals Resume

WASHINGTON — The Federal Bureau of Investigation has formally blamed North Korea for the theft of more than $6 billion in virtual assets from Binance, the world’s largest cryptocurrency exchange, identifying the state-linked hacking unit TraderTraitor as the force behind the largest crypto heist on record. The attribution, issued on October 31, landed as Binance began restoring customer withdrawals on Sunday after covering about 95 percent of the stolen funds from its own reserves.

According to the FBI, TraderTraitor actors stole the assets on or about October 29 and have since been converting them primarily into Ethereum, the second-largest cryptocurrency, in preparation for further laundering through decentralised finance platforms and instant-swap services. The agency issued the alert jointly with the United States Secret Service and the criminal investigation division of the Internal Revenue Service, and published hundreds of wallet addresses it links to the laundering operation, urging exchanges, node operators and analytics firms to block transactions tied to them.

The attribution Washington had been building toward

Private blockchain investigators had pointed at North Korea within hours of the theft, but the FBI statement turns that assessment into the formal position of the United States government. blockchain intelligence firm TRM Labs estimated the haul at about $6.36 billion drained from Binance wallets across 10 blockchain networks, most of it in a single burst lasting roughly 20 minutes. The figure dwarfs the previous record: the $1.5 billion stolen from the Bybit exchange in February 2025, an attack the FBI also blamed on TraderTraitor.

TraderTraitor is described by American officials as a subunit of the Lazarus Group, the North Korean hacking collective accused of some of the biggest crypto thefts of recent years, including about $620 million taken from the Ronin network in 2022. Pyongyang has for years denied using state-linked cyber units for espionage or financial theft. American officials have long accused North Korea of using stolen cryptocurrency to fund its weapons programmes, an allegation Pyongyang rejects, and blockchain firm Chainalysis estimated that North Korean hackers stole $2.02 billion in crypto during 2025 alone, before the Binance theft.

How the money moved

Binance has said the attackers drained its hot-wallet infrastructure, the online wallets used to process day-to-day withdrawals, rather than thousands of individual customer accounts. Co-chief executive Richard Teng described the breach as a complex attack involving a compromised employee laptop and malicious software designed to delete evidence of its activity, making the intrusion harder to trace. The company later reported additional breach points and said it had found no evidence that wallet private keys were exposed.

TRM Labs said that on Ethereum, the attacker used a wallet feature to direct Binance’s hot wallet to move assets under the attacker’s control, pointing to a compromise of the exchange’s transaction-signing infrastructure rather than a stolen master key. The company has not published a full technical account of the intrusion, and investigators are still examining exactly how the attackers gained entry. What is clear from the on-chain trail is speed: billions of dollars in tokens moved in minutes, then began scattering across networks as investigators raced to freeze them.

The freeze race and the 95 percent recovery

The race to freeze the funds produced sharply different tallies depending on the counter, a sign of how fast the money is moving. Stablecoin issuers froze more than $2.4 billion of the stolen assets, TRM Labs put the frozen total near $2.7 billion, and Binance itself cited about $3 billion frozen with the help of industry partners. Much of the remainder, largely in bitcoin and ether, sits beyond any single issuer’s reach, and the FBI expects the launderers to keep splitting the funds across tens of thousands of addresses in the coming weeks.

Binance has pledged to absorb the full financial impact so customers suffer no losses. The exchange said it set aside more than $6.34 billion in company funds, drawing on its $1 billion Secure Asset Fund for Users, its futures insurance fund and its corporate treasury, to buy replacement tokens. It reported 90 percent of the affected assets replenished on Saturday and about 95 percent by Sunday, with co-founder Yi He saying half of the Secure Asset Fund for Users would be used to cover hack losses while the other half stays in reserve. The remaining 5 percent consists of less liquid assets that may take longer to source in the required amounts.

Withdrawals reopen in phases

Binance said the first phase of restored withdrawals would run between 0600 and 0900 GMT on Sunday, covering bitcoin, ether, BNB, Solana, XRP, dogecoin and other major tokens, with further networks reopening after security checks. The reopening is the clearest signal yet that the exchange believes the worst of the operational crisis is past, even as the criminal investigation is only beginning. For an industry that has spent years promising that its largest venues are safe, the sight of the biggest exchange in the world losing more than $6 billion in minutes, then covering the loss from its own balance sheet, will shape the debate over custody, insurance and regulation for months.

That debate reaches well beyond crypto trading desks. The theft is now one of the largest cyber incidents of any kind on record, and the FBI’s public attribution puts a state actor at the centre of it days before a major American election week. Regulators in the United States, Europe and Asia have already been pressing exchanges to prove they can segregate customer assets, survive a breach and cooperate with law enforcement; the Binance case will be Exhibit A in every one of those arguments, whatever investigators ultimately recover.

What happens next

The immediate fight is over the laundering trail. The FBI listed more than 600 Ethereum addresses, just under 20 bitcoin addresses and a single Solana address in its notice, and asked private-sector firms including THORNode operators, RPC node operators, instant exchanges, decentralised finance services and blockchain analytics firms to block transactions with or derived from those addresses. Chainalysis warned that tens of thousands of additional addresses are likely to be used as the attackers keep moving the funds, a pattern seen in earlier North Korean-linked thefts, where stolen coins were mixed with proceeds from other hacks to obscure their origin.

For Binance, the test now shifts from repayment to trust. The exchange has restored most of the stolen value and reopened withdrawals, but it has yet to explain fully how its signing infrastructure was compromised, and investigators have not identified individual perpetrators. For its customers, the practical question is simpler: whether the world’s largest crypto exchange can keep their money safe the next time attackers come calling. The FBI’s answer to who did it this time is now on the record; the harder question of how to stop the next theft remains open.