The Federal Bureau of Investigation announced on Saturday that North Korea executed the $6.3 billion cryptocurrency theft from Binance, setting a new record for the largest digital asset breach ever recorded. In an official cyber alert, the agency pointed to a state-sponsored hacking collective called TraderTraitor as the culprit behind the incident.
North Korea now holds the dubious distinction of responsibility for the two largest digital currency heists in history, having previously directed the $1.5 billion theft targeting the Bybit exchange last year.
Binance assured customers that they will avoid financial losses, noting that the trading platform has already used corporate funds to replace approximately 90% of the missing capital.
What FBI Said
"The FBI is releasing information advising the Democratic People's Republic of Korea was responsible for the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026," the bureau said.
Investigators tracked the stolen digital funds shifting primarily into Ethereum, working alongside the US Secret Service and the IRS Criminal Investigation division. Authorities anticipate that the culprits will attempt further laundering operations through instant crypto-swap services and decentralized finance platforms.
Virtual asset service providers, blockchain operators, and crypto exchanges received requests from the agencies to block any transactions connected to the wallet addresses used by the North Korean hackers.
How the Hack Happened
Capital began draining from the online hot wallets of Binance during the afternoon of October 29, calculated in US Eastern Time. The funds traversed multiple blockchains within a matter of minutes.
Richard Teng, the co-CEO of Binance, described the event as a complex attack. He explained that the operation involved a compromised laptop alongside malicious software built to erase logs of the activity, which complicated tracking efforts.
Prior to the statement from the FBI, blockchain analytics enterprises Chainalysis and TRM Labs already connected the assault to TraderTraitor, a group associated with the Lazarus Group. Chainalysis reported that stolen Binance capital merged on-chain with funds taken during the Bitget hack last month, another incident attributed to North Korea, and calculated that roughly $2.8 billion of the stolen total is currently frozen.
What This Means for You
Customers holding digital assets on Binance will not suffer financial harm, according to the platform. Teng stated on X that the company has replenished 90% of the stolen capital and remains dedicated to covering the rest, ensuring users bear no financial impact.
According to Binance, balances in Bitcoin, Ethereum, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD, and Zcash maintain full backing. The remaining 10% involves less liquid tokens requiring additional time for acquisition.
To bridge the deficit, the company allocated approximately $6.34 billion from its own reserves, tapping into the corporate treasury, the Futures Insurance Fund, and a portion of the Secure Asset Fund for Users.
Following the security breach, withdrawal services were temporarily suspended. Binance stated that services are scheduled to resume on Sunday, pending final safety verifications.
Clients should anticipate potential delays and monitor official company communication channels for updates, given that scammers frequently target individuals following major cyber attacks.
The broader implications present cause for concern, as the $6.3 billion theft quadruples the size of the Bybit breach and demonstrates that even the leading global exchange remains vulnerable to state-backed threat actors.
North Korea's Record of Crypto Theft
Past accusations from the FBI implicate North Korean hackers in multiple major digital currency heists, including the $620 million theft in 2022 and the $1.5 billion Bybit breach from the previous year.
According to experts, the administration of Kim Jong Un uses cyber attacks to generate revenue for the heavily sanctioned nation. Reports indicate that North Korea selects top university students for enrollment into hacking cells managed by state intelligence agencies.
Binance maintains an expanding footprint in Pakistan, having obtained a No Objection Certificate to initiate local registration procedures last year. ProPakistani initially broke the news regarding the suspected Binance breach earlier in the week.
