FBI says North Korea behind US$6bil crypto theft from Binance

The Federal Bureau of Investigation (FBI) has attributed a massive hack to North Korea, resulting in the theft of over US$6 billion in virtual assets from cryptocurrency exchange Binance. The breach occurred on October 29, 2026, with Binance initially suspending user withdrawals. However, the exchange announced on Sunday that it had resumed withdrawals in phases, with the first batch beginning that same day.

Binance, the world's largest crypto exchange by daily trading volumes, suffered a significant loss of virtual assets, causing the prices of major cryptocurrencies to plummet. The company has assured customers that it will cover the losses, using company funds to replenish 90% of the stolen assets. The remaining 10% of tokens are less liquid and may take longer to acquire.

The FBI's statement confirmed earlier suspicions that a Pyongyang-affiliated group called TraderTraitor was responsible for the hack. TraderTraitor, also blamed for a US$1.5 billion theft from the Bybit platform in February 2025, is believed to be part of the Lazarus Group, notorious for hacking Sony Pictures in 2014. The FBI warned that TraderTraitor actors have converted stolen assets into Ethereum, and they expect those assets to be laundered further through decentralized finance and instant swap services.

The agency urged private sector entities to block transactions with or derived from addresses used by TraderTraitor actors for laundering stolen assets.

Binance, the world's largest crypto exchange, pledged to fully cover the financial impact of the stolen funds, having set aside over US$6.34 billion in company funds. The exchange implemented a phased approach to resume withdrawals, prioritizing tokens based on user demand to ensure stability and security.