WASHINGTON, November 1: The FBI has blamed North Korea for the theft of about $6.3 billion in cryptocurrency from Binance, the largest crypto heist on record, naming the hacking group it calls TraderTraitor. Binance, which disclosed the breach last week, says it will absorb the loss and has already replaced about 90% of the stolen assets from its own funds, with customer withdrawals resuming in phases from Sunday.
Key highlights
- In a statement on Saturday, October 31, the FBI attributed the Binance theft to North Korea’s TraderTraitor group.
- The FBI said the stolen assets were being converted mainly into Ethereum and would be laundered further in stages; it asked crypto service providers to block related transactions and published suspect addresses.
- Binance co-CEO Richard Teng described a “complex attack” that began with a compromised laptop and malicious software designed to erase traces of activity.
- Binance says it has covered about 90% of the loss using its Secure Asset Fund for Users (SAFU) and corporate funds; partners have frozen roughly $3 billion of stolen assets.
- The same group was blamed by the FBI for the $1.5 billion Bybit theft in February 2025.
What the FBI said
The FBI’s alert names TraderTraitor, a North Korean state-backed cyber unit, as responsible for the theft. It says the stolen funds are moving mainly into Ethereum and are expected to be laundered further in stages. The bureau urged virtual asset service providers to block transactions linked to the addresses it listed.
The attribution came a day after the foreign ministers of the United States, Japan and South Korea, meeting in Atlanta on October 30, called for full implementation of UN Security Council resolutions, including the ban on helping North Korea earn money for its nuclear and ballistic missile programmes.
How Binance is covering the loss
Binance said investigators first suspected a single compromised employee laptop but later found further points of entry. The exchange says it set aside more than $6.34 billion to cover users, including $5 billion in the affected cryptocurrencies, and drew on the part of its SAFU fund above its required size, which it plans to restore to about $1 billion. The company published a proof-of-reserves snapshot taken at midnight UTC on October 31 showing at least 1:1 backing for major tokens including bitcoin, ether, USDT, BNB, SOL, USDC and XRP, and said a full cryptographic proof would follow by November 3.
| Item | Figure |
|---|---|
| Amount stolen | About $6.3 billion |
| Attributed to | North Korea’s TraderTraitor (FBI, October 31) |
| Covered by Binance so far | About 90% (company statement, October 31) |
| Funds Binance set aside | More than $6.34 billion, including $5 billion in affected tokens |
| Stolen assets frozen by partners | About $3 billion |
| Withdrawals | Resuming in phases from November 1 |
| Previous record | $1.5 billion stolen from Bybit, February 2025 (also attributed to North Korea by the FBI) |
Our calculation
- Record by a wide margin: $6.3 billion is about four times the $1.5 billion Bybit theft, the previous record.
- What has been replaced: 90% coverage equals roughly $5.7 billion of the stolen amount; the remaining 10%, about $630 million, is in less liquid tokens.
- What has been frozen: the $3 billion frozen by partners is close to half of the stolen total — but frozen funds are not the same as recovered funds.
What it means for Asia
For North Korea’s neighbours, the theft is a sanctions problem as much as a cyber-crime one. Cryptocurrency theft has become a major source of foreign currency for Pyongyang, and the trilateral statement in Atlanta explicitly targets the revenue that funds its weapons programmes. Exchanges in South Korea, Japan, Singapore, Hong Kong and India may face pressure to screen deposits more strictly as the stolen funds are laundered. For ordinary users, the episode shows the difference between a platform’s promise to cover losses and the time it takes to restore full access.
What to watch
- Binance’s full cryptographic proof of reserves, promised by November 3, and the reopening of all withdrawals.
- Further FBI or Treasury actions, including sanctions on wallets or intermediaries.
- How much of the frozen $3 billion is actually returned.
- Any response from North Korea, which has denied involvement in past thefts.
File photo: FBI headquarters, the J. Edgar Hoover Building, in Washington, June 2024. Image: ajay_suresh, CC BY 2.0, via Wikimedia Commons. Photo source · Licence
Sources
- FBI: North Korea responsible for $6 billion+ Binance attack (alert, 2026)
- FBI: North Korea responsible for $1.5 billion Bybit hack (alert, 2025)
- Binance (official X account): security incident notice
- US Department of State: US–Japan–ROK trilateral foreign ministers’ meeting, October 30, 2026
The Tech Desk covers technology, artificial intelligence and cybersecurity. Stories are checked against at least two credible sources before publication.
