FBI Blames North Korea for $6.3 Billion Binance Hack, the Largest Crypto Theft on Record

The United States Federal Bureau of Investigation (FBI) said on 31 October 2026 that North Korea was responsible for the theft of more than $6 billion in virtual assets from the cryptocurrency exchange Binance, in what investigators and analysts describe as the largest cryptocurrency theft ever recorded. The announcement, made just two days after the money disappeared, turns a dramatic exchange security failure into a major international incident — one that links the world's largest crypto exchange, a state-backed hacking operation, and a fast-moving effort to freeze and trace stolen funds before they vanish into the wider financial system.

What happened on 29 October

On Thursday 29 October 2026, about $6.3 billion in digital assets moved out of Binance's hot wallets — the internet-connected wallets an exchange uses to process everyday withdrawals. Reports from blockchain analytics firms put the total at slightly different figures because each firm values the assets at a different moment: Binance puts the loss at about $6.3 billion, TRM Labs at about $6.36 billion, and Elliptic at about $6.43 billion. The small differences do not change the scale of the event. By any measure, it dwarfs the previous record.

Deposits and withdrawals were paused as Binance responded. The exchange later said that about $3 billion of the stolen assets had been frozen with help from token issuers and other firms. That frozen figure matters, but it should not be confused with money returned to customers. Frozen assets are stopped in their tracks; they are not yet recovered, and returning them is a separate legal and technical process.

TRM Labs said about $6.36 billion left Binance wallets across 10 blockchains, most of it in about 20 minutes.

The FBI's announcement on 31 October

On Saturday 31 October, the FBI released an alert stating that North Korea "was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026." The bureau identified the activity as "TraderTraitor," the name it uses for a North Korean hacking operation that targets cryptocurrency platforms and investors.

The FBI said it was working with the United States Secret Service and the Internal Revenue Service's Criminal Investigation division. Together, the agencies said they had observed the attackers converting stolen assets primarily into ether, the cryptocurrency of the Ethereum network. They warned that further conversions were expected through decentralised finance platforms — services that let users swap assets without a central exchange — and instant-swap services that exchange one cryptocurrency for another.

The alert also took a practical step: it listed addresses linked to the laundering effort and urged cryptocurrency exchanges, blockchain infrastructure operators, analytics firms, and other digital asset service providers to block transactions involving or originating from those addresses. CoinDesk reported that the FBI listed more than 600 Ethereum addresses, just under 20 Bitcoin addresses, and a single Solana address. That list is the industry's most concrete tool for slowing the money down, because every blocked transfer narrows the routes the attackers can use.

President Donald Trump had said on 30 October that United States officials were looking into the hack and possible North Korean involvement. The FBI's statement the next day moved that question from speculation to an official attribution.

How investigators traced the theft so quickly

Private analytics firms reached the same conclusion as the FBI within hours of the attack, using public blockchain records rather than classified material. That is one of the unusual features of cryptocurrency crime: the ledger is public, so the movement of funds can be watched in real time even when the people behind the wallets remain hidden.

Chainalysis, TRM Labs, and Elliptic all pointed to TraderTraitor. According to reporting on their findings, Chainalysis found that stolen Binance funds were mixed with proceeds from a September 2026 theft from the exchange Bitget, which had already been tied to North Korea. Elliptic reported shared service usage with three earlier TraderTraitor thefts, at BigONE, WOO X, and AFX. These links do not prove guilt on their own, but together they form the pattern investigators rely on: the same tools, the same laundering routes, and the same fingerprints across multiple thefts.

TraderTraitor is described as a subunit of the Lazarus Group, the North Korean hacking collective the FBI blamed for the $1.5 billion theft from the exchange Bybit in February 2025. That theft was the previous record. The Binance theft is roughly four times larger, which suggests the operation behind it has grown in ambition and capability, not shrunk after being publicly named.

Binance's response: 90 percent replenished, withdrawals due back

For Binance customers, the most important question is simple: will they lose money? Binance says no. The exchange said it set aside more than $6.34 billion in company funds to cover the theft, drawing on its SAFU emergency reserve fund, part of its futures insurance fund, and its corporate treasury.

On 31 October, Binance said it had replenished about 90 percent of the stolen assets through market and over-the-counter purchases, with 10 cryptocurrencies — including Bitcoin, Ethereum, and XRP — fully backed. It said it remained on track to reopen withdrawals on Sunday 1 November, subject to security checks and final confirmation, and planned to publish a proof-of-reserves report shortly afterwards.

It is important to understand what "90 percent replenished" actually means. It does not mean Binance recovered 90 percent of the stolen money from the attackers. It means Binance refilled the missing balances with its own money, so customer accounts can be made whole from the company's reserves. That distinction matters: the company's balance sheet and the criminal investigation are two different stories, and progress in one does not automatically mean progress in the other.

Why North Korea targets cryptocurrency

Western governments have long accused North Korea of using cyber theft to raise money in defiance of international sanctions. Because the country is largely cut off from the normal banking system, stolen cryptocurrency offers a way to move large sums across borders without going through a bank. Once converted through decentralised platforms and swap services, the funds can be passed through chains of fresh wallets and, eventually, over-the-counter brokers who convert crypto into cash.

Elliptic has estimated that North Korea-linked actors have stolen more than $6.5 billion in recent years, including more than $1 billion in 2026 before the Binance incident. Those figures are estimates from a private firm, not official totals, but they underline why American officials treat crypto theft as a national security issue rather than a simple financial crime.

The same sanctions logic connects this story to wider global pressures, as shown in our earlier reporting on the Hormuz crisis and the UN warning of a global food emergency.

What this means for ordinary crypto users

The Binance hack is a reminder that even the largest exchange is not immune to a major breach. Hot wallets are convenient, but because they are connected to the internet, they are the first target in any attack. Exchanges keep most customer funds in cold storage — wallets kept offline — precisely for this reason, and Binance's ability to cover the loss from its own reserves shows why large reserves matter.

For individual users, the practical lessons are worth repeating. Keep only the funds you actively trade on an exchange, and store longer-term holdings in a wallet you control. Use strong, unique passwords and two-factor authentication. Never share recovery phrases with anyone, and treat any message offering to "recover" stolen funds as a scam unless it comes through an exchange's verified official channel. This article is not financial advice, and it does not recommend buying, selling, or holding any cryptocurrency.

What remains unknown, and what happens next

Several important questions have no confirmed answer yet. First, how did the attackers gain access to Binance's hot wallets? Neither Binance nor the FBI has publicly described the initial intrusion in detail, and early speculation about the method should be treated with caution. Second, how much of the frozen $3 billion can actually be returned, and on what timetable? Freezing is only the first step. Third, will the attackers succeed in laundering the rest through decentralised platforms, as the FBI expects, or will the published address list and industry cooperation stop them?

The diplomatic dimension is also unresolved. North Korea has not, in the reporting reviewed for this article, admitted responsibility, and past attributions of this kind have rarely led to arrests. The practical consequence of the FBI's statement is therefore more likely to be financial — blocked addresses, frozen assets, and pressure on intermediaries — than legal.

That diplomatic uncertainty is familiar from other fast-moving crises. Public statements by leaders often set the tone before the facts are fully established, as readers saw in our coverage of Trump's accusation that Zelensky does not want to end the Ukraine war, where the statement itself became part of the story. In the Binance case, the sequence ran the other way: a presidential comment on 30 October was followed a day later by a formal FBI attribution, giving the claim an official footing that earlier speculation lacked.

In the coming days, three things are worth watching. The first is whether Binance reopens withdrawals on schedule on 1 November and publishes the promised proof-of-reserves report — the clearest test of its claim that customers are protected. The second is whether the amount of frozen assets grows beyond $3 billion as more firms act on the FBI's address list. The third is whether the laundering pattern follows the path seen after the Bybit theft, when stolen ether moved through cross-chain swaps, chains of fresh wallets, and over-the-counter brokers over several weeks.

The long-term question is whether an attack of this size changes how exchanges are regulated and supervised. A $6.3 billion theft, attributed by the FBI to a state-backed group, is hard for regulators to ignore. It strengthens the case for stronger security standards, larger reserves, and faster information-sharing between exchanges and law enforcement.

For now, the confirmed core of the story is clear enough: on 29 October, more than $6 billion left Binance; on 31 October, the FBI blamed North Korea's TraderTraitor operation; Binance says it has covered the loss and plans to restore withdrawals. Everything else — the recovery, the laundering chase, and the regulatory response — is still unfolding. Just as multilateral diplomacy continues to shape other conflicts — including the proposals examined in our report on India's three-part peace plan to end the Ukraine war — the Binance case will test whether international cooperation can keep pace with criminals who operate across borders in minutes. That test, more than any single figure, is why this hack will be remembered.