FBI Blames North Korea for $6.3 Billion Binance Theft

The FBI said the theft from Binance, discovered after an attack on or about October 29, was carried out by North Korean hackers linked to a cyber campaign known as TraderTraitor. The bureau described the incident as one of the largest cryptocurrency heists and said the same actors were connected to last year’s $1.5 billion Bybit hack.

FBI investigators, along with personnel from the U.S. Secret Service and IRS Criminal Investigation, tracked the hackers as they changed much of the stolen cryptocurrency into Ethereum. Officials anticipate the money may pass through decentralized-finance platforms and rapid-swap services.

The FBI urged crypto exchanges, blockchain analysis companies and other providers of digital assets to block transactions tied to wallet addresses associated with the hackers. It also asked anyone with information about the theft or laundering to contact the bureau.

Binance said an initial investigation indicated that a software engineer’s laptop may have been compromised, allowing the attackers to access its systems and approve withdrawals. The exchange said it had set aside enough assets to cover about 90% of the loss and would fully reimburse customers.

President Donald Trump said on October 31 that investigators were still learning about the incident and that they did not yet know whether North Korea was responsible. Blockchain expert Ari Redbord said the stolen funds could be divided and routed through smaller exchanges, potentially making recovery efforts a prolonged effort to trace and disrupt the money’s movement.

North Korean Crypto Heist Puts Cybersecurity Failures in Focus

A $6.3 billion theft from Binance is a stark warning about the vulnerabilities of major financial platforms—and the growing reach of state-backed cybercrime. On October 31, the FBI attributed the attack, which took place on or about October 29, to North Korean hackers operating under the TraderTraitor campaign.

The bureau said investigators saw the stolen assets being converted mainly into Ethereum and warned that the money might pass through decentralized-finance platforms and rapid-swap services. It called on exchanges and other digital-asset providers to block transactions tied to the hackers’ addresses.

Binance said an engineer’s laptop may have been compromised, helping attackers gain access to the company’s systems and authorize withdrawals. The exchange said it had replenished about 90% of the stolen assets and would reimburse customers fully. That promise offers reassurance, but it does not erase the security failure that allowed a theft of this scale.

President Donald Trump said investigators did not yet know whether North Korea was responsible. The FBI’s attribution and its warning about laundering routes make clear that the challenge now is to stop the stolen money from moving further and hold those responsible to account.

FBI Targets North Korean Crypto Theft as Binance Pledges Repayment

The FBI has tied a $6.3 billion Binance theft to North Korean hackers, identifying the activity as part of the TraderTraitor campaign. The bureau said the attack happened on or about October 29 and urged cryptocurrency businesses to block transactions linked to the stolen funds.

Investigators said the hackers were converting assets mainly into Ethereum and could try to obscure their movement using decentralized-finance platforms and rapid-swap services. The FBI’s warning underscores how cyber theft can become a route for North Korea to obtain funds while authorities race to follow the money.

Binance said a software engineer’s laptop may have been compromised, opening a path into company systems and allowing withdrawals to be approved. The exchange said it had replenished about 90% of the stolen assets and would reimburse customers in full, taking the financial hit rather than passing it to users.

Trump said on October 31 that investigators were still gathering information and had not established whether North Korea was involved. That caution matters: attribution should be grounded in evidence, even as federal agencies press exchanges and service providers to help prevent laundering. The next step is tracing the assets and disrupting attempts to move them.