FBI: North Korea stole $6B in crypto from Binance

FBI identifies Pyongyang in record crypto heist

The Federal Bureau of Investigation on Saturday publicly accused North Korea of orchestrating the theft of more than $6 billion in virtual assets from Binance, the world's largest cryptocurrency exchange, identifying the Pyongyang-affiliated TraderTraitor group as the perpetrator of what analysts have called the biggest digital currency heist in history. "The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026," the agency said in a statement.

The bureau noted it had observed "TraderTraitor actors" converting stolen assets into Ethereum and expected further laundering through decentralized finance platforms and instant swap services. US President Donald Trump publicly questioned the attribution late Saturday, telling reporters at his Florida residence: "I'm not concerned. We're learning about it. We don't know if it's North Korea." The president has frequently highlighted his diplomatic engagements with North Korean leader Kim Jong Un during his first term.

Binance moves to cover losses as withdrawals resume

Binance pledged to fully cover the financial impact, announcing Saturday it had allocated more than $6.34 billion in company funds to repurchase tokens and replenish 90 percent of the missing assets. "Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident," the exchange said on X, adding that the remaining 10 percent comprised "less liquid, which means they may take longer to source in the required amounts."

The exchange suspended user withdrawals immediately after detecting the October 29 breach but began phased resumption Sunday morning, prioritizing networks based on user demand data. Binance described the incident as a "complex attack" involving multiple points of breach, prompting sharp declines across cryptocurrency markets — Bitcoin fell nearly five percent, Ethereum dropped six percent, and the exchange's native BNB token tumbled almost 10 percent.

Sanctions-evasion tactics under scrutiny

The FBI confirmed suspicions from private investigators that TraderTraitor — the same group blamed for a $1.5 billion theft from Bybit in February last year — executed the Binance hack. The collective is believed to operate as part of the Lazarus Group, which gained notoriety in 2014 for hacking Sony Pictures over the film "The Interview" that mocked Kim Jong Un.

Pyongyang faces extensive international sanctions over its nuclear and missile programs, driving the isolated regime to pursue illicit revenue streams through cyber operations targeting financial institutions worldwide. The FBI urged private sector entities "to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets," warning that the hackers would likely continue converting funds through instant swap services.