Alert: FBI Blames North Korea for $6.3B Binance Hack in Largest Crypto Heist

The FBI has accused North Korea of orchestrating the $6.3 billion Binance hack, marking the largest cryptocurrency theft in history. Federal investigators identified a North Korean cyber operation known as TraderTraitor as responsible for the October 29 security breach.

According to a statement from the FBI Cyber Branch, North Korean hackers stole more than $6 billion in digital assets. The agency also confirmed that investigators had identified movements involving the stolen cryptocurrency across several blockchain networks.

The attack targeted Binance, the world’s largest cryptocurrency exchange, with billions of dollars disappearing from its wallets within minutes. Blockchain intelligence firm TRM Labs estimated that attackers transferred approximately $6.36 billion across ten blockchain networks. According to TRM Labs, most stolen assets left Binance wallets within 20 minutes, surpassing the $1.5 billion Bybit hack attributed to North Korea in February 2025.

Also Read: Renaat Ver Eecke: Early Life and Net Worth – The Ripple Executive Leading Treasury Operations

 FBI Identifies North Korea’s TraderTraitor Operation Behind Binance Hack

The FBI linked the Binance theft to TraderTraitor, a North Korean cyber operation previously associated with major cryptocurrency attacks. Investigators also revealed that the hackers had started converting stolen assets primarily into Ethereum as part of their laundering activities.

According to the FBI, the attackers could move additional funds through decentralized finance platforms and instant cryptocurrency exchange services. These transactions could allow the stolen assets to pass through multiple wallets and blockchain networks.

The agency has joined forces with the United States Secret Service and the Internal Revenue Service Criminal Investigation division. Together, the agencies are tracking cryptocurrency addresses associated with the suspected North Korean hackers. Additionally, federal authorities urged cryptocurrency businesses to block transactions involving wallets connected to the stolen Binance assets.

The warning specifically targeted decentralized finance providers, blockchain analytics companies, instant exchanges, THORNode operators, and RPC node operators. Investigators also released information identifying suspicious cryptocurrency addresses to help industry participants prevent further movement of the stolen funds.

Binance Moves to Cover Losses Following Historic $6.3 Billion Theft

Binance has taken steps to reimburse affected customers following the security breach, which disrupted cryptocurrency withdrawals across several networks. The exchange confirmed that it had secured sufficient reserves in the affected cryptocurrencies to cover approximately 90% of the losses.

Meanwhile, blockchain intelligence firm TRM Labs reported that approximately $2.7 billion in stolen assets had been frozen. The restrictions involved stablecoin issuers and blockchain security authorities working to prevent the hackers from accessing the funds.

TRM Labs also identified significant transfers involving Bitcoin, Ethereum, XRP, and other cryptocurrencies during the attack. Its investigation linked the incident to North Korean cyber operations based on blockchain activity and additional intelligence. Separately, US President Donald Trump questioned whether investigators had conclusively established North Korea’s involvement during a Saturday appearance at Mar-a-Lago.

“We don’t know if it’s North Korea,” Trump remarked while responding to reporters about the cryptocurrency theft.

Despite Trump’s comments, the FBI has publicly attributed the Binance attack to TraderTraitor and requested cooperation from cryptocurrency service providers. Federal investigators are pursuing the stolen assets as Binance works to restore customer balances and strengthen its security infrastructure.

Also Read: Peter Schiff Warns Bitcoin Could Crash to $75,000 as BTC Falls Below $80,000