FBI blames North Korea for $6.3bn Binance crypto hack

Federal law enforcement stepped in on Saturday to formally attribute the largest digital asset heist in history to Pyongyang, capping a frantic three-day scramble that began when hackers drained more than $6 billion from Binance. The Federal Bureau of Investigation announced that a state-sponsored North Korean hacking campaign known as TraderTraitor executed the breach on or about October 29, 2026, pilfering virtual assets across ten blockchains in a span of about 20 minutes.

The swift determination by Washington provided an official answer to days of speculation from private security analysts and blockchain intelligence firms. According to the FBI, the operation was conducted jointly with the U.S. Secret Service and the IRS Criminal Investigation division. As investigators traced the digital footprint, blockchain intelligence firm TRM Labs estimated that the hackers moved approximately $6.36 billion from exchange wallets, immediately setting off alarms across the global financial system and erasing billions in market value.

How did the hackers drain $6.3 billion in minutes?

The mechanics of the breach reveal a high level of operational sophistication designed to bypass modern security architecture. Binance co-CEO Richard Teng described the incursion as a complex attack that exploited a compromised laptop and malicious software engineered to automatically erase activity traces. By wiping its own digital footprints, the malware significantly raised the bar for tracking and investigation during the critical opening hours.

Blockchain analytics firms quickly noted that the stolen funds were spread across ten distinct blockchains, with the bulk of the transfers concentrated within a tight 20-minute window. The sheer velocity of the extraction overwhelmed standard monitoring tools and caught the world's largest cryptocurrency exchange by daily trading volumes off guard. Binance immediately suspended user withdrawals to contain the bleeding, plunging millions of account holders into uncertainty while executives scrambled to assess the damage.

TraderTraitor is believed to be part of the Lazarus Group, which gained notoriety in 2014 when it was accused of hacking into Sony Pictures as revenge for The Interview, a film that mocked North Korean leader Kim Jong-un. Federal agencies previously tied the same network to a roughly $1.5 billion theft from the Bybit platform in February last year and a $620 million virtual asset breach in 2022.

The sudden evaporation of funds sent immediate shockwaves through traditional and digital markets alike. Bitcoin plunged nearly 5% following the news of the hack, while Ethereum dropped nearly 6%. BNB, the native token of the Binance platform, tumbled nearly 10% as investors digested the existential threat posed to the exchange's liquidity reserves.

How is Binance covering the missing billions?

Faced with a catastrophic shortfall, Binance moved aggressively to reassure jittery customers and stave off a debilitating bank run. The exchange announced it had set aside around $6.34bn of company funds to absorb the blow, drawing resources from a $1bn Secure Asset Fund for Users (SAFU), its Futures Insurance Fund, and its own corporate treasury.

By Saturday, the exchange reported that it had successfully purchased new tokens to replenish 90% of what was stolen. The remaining 10% consists of less liquid tokens that require more time to source in the required quantities. Binance also announced the publication of a new proof-of-reserves snapshot, allowing users to independently verify that their assets were backed at a minimum 1:1 ratio. Teng issued a direct pledge to calm the market: users will not bear the financial impact of this incident. Binance confirmed that user withdrawals, which were frozen immediately after the breach, were on track to resume on Sunday.

We will continue to buy the remaining relevant token assets… until the covered amount reaches 100 [percent] for all tokens. Binance will absorb the financial impact of these stolen funds, not our users

Binance, via X and The Guardian

Despite the company's aggressive capitalization, financial analysts warned that the balance sheet pressure has not entirely dissipated. Absorbing billions in losses in a matter of days strains even the deepest corporate treasuries, and the exchange must still navigate the logistical challenge of acquiring the remaining illiquid assets without driving up market prices against itself.

What are law enforcement and the hackers doing with the stolen money?

With the initial smash-and-grab complete, federal investigators and North Korean operatives are now engaged in a high-stakes digital chess match across the blockchain. The FBI disclosed that it observed TraderTraitor actors converting the stolen virtual assets primarily into Ethereum. Law enforcement agencies expect the hackers to route these holdings through decentralized finance protocols and instant swap services to obscure their origin.

In a rare public maneuver, federal authorities issued an urgent warning to private sector entities, including THORNode node operators, RPC node providers, instant exchange platforms, and DeFi service providers. The agencies urged the industry to immediately block transactions connected to specific wallet addresses published by investigators. Ari Redbord, chief policy officer at blockchain intelligence firm TRM Labs, explained that hackers typically break stolen assets into smaller pieces and launder them through secondary exchanges over several months. However, we can also track and trace those funds in real time in order to build investigations, to disrupt and to seize back funds, Redbord noted.

That bottom-up defense strategy relies heavily on the willingness of decentralized platforms to cooperate with state orders. Whether unregulated or autonomous liquidity pools will voluntarily freeze funds remains an open question that will dictate how much of the $6.3 billion can ultimately be recovered.

Where does political skepticism leave the investigation?

While federal investigators pointed the finger directly at Pyongyang, political crosscurrents introduced an unexpected note of friction. Speaking to reporters at his residence in Florida late Saturday, U.S. President Donald Trump cast doubt on the official attribution. I'm not concerned. We're learning about it. We don't know if it's North Korea, Trump said. The president's remarks highlighted the delicate geopolitical backdrop surrounding North Korea, a nation that faces extensive international sanctions over its nuclear and missile programmes to find illicit means to capture revenue.

That political disconnect leaves investigators pushing forward under institutional urgency while diplomats weigh the fallout from the largest virtual asset theft in history. For investors and regular users, the immediate crisis of account liquidity has been largely managed by Binance's corporate reserves, but the broader vulnerability of centralized crypto exchanges to state-sponsored military hackers remains starkly unresolved ahead of Sunday's scheduled resumption of withdrawals.