The US Federal Bureau of Investigation has formally blamed North Korea for the record $6.3 billion theft from cryptocurrency exchange Binance, turning what began as an industry investigation into an official accusation against a state-linked hacking unit. The bureau said on Saturday that the attack was carried out by TraderTraitor, a North Korean state-sponsored unit whose members were observed converting the stolen assets into Ethereum.
The theft, which drained billions from Binance wallets in a matter of minutes, is the largest cryptocurrency heist on record. It has already reshaped the debate about how exchanges protect customer money, how fast stolen crypto can be laundered, and how governments respond when a hack is traced to a foreign state.
Key Takeaways
- The FBI has blamed North Korea’s TraderTraitor unit for the record $6.3 billion Binance hack.
- Binance says it has covered about $6 billion of the losses with company money, and plans phased withdrawal resumption.
- The FBI warned that further laundering is expected and asked crypto firms to block suspect transactions.
What the FBI Said
According to the FBI statement reported on Saturday, TraderTraitor was responsible for the attack on Binance. The bureau said members of the unit were observed by law enforcement converting stolen assets into Ethereum, and it expects further laundering attempts, including through decentralised finance platforms.
The FBI also called on virtual asset service providers, blockchain analytics firms and other companies to block transactions linked to addresses it identified, in an effort to stop the money being moved and hidden. North Korea has for years denied using state-linked cyber units for espionage, financial theft and revenue generation.
The official attribution follows earlier analysis from blockchain intelligence firms. TRM Labs and Chainalysis had already pointed to TraderTraitor as the likely culprit, and TRM Labs said the pattern matched earlier North Korea-linked thefts, including last year’s $1.5 billion Bybit hack. The FBI statement now puts the weight of a US law enforcement agency behind that assessment.
How Binance Is Covering the Losses
Binance, the world’s largest cryptocurrency exchange, said on Saturday that it had covered $6 billion of the $6.3 billion stolen by using company money to buy replacement tokens. Binance’s earlier update on covering the losses set out the same approach: customers would not bear the financial impact of the incident.
The company said it had set aside around $6.34 billion of company funds internally to cover the losses. The money came from part of its $1 billion Secure Asset Fund for Users, known as SAFU, a bitcoin reserve held to protect customers in the event of security breaches, as well as some of its Futures Insurance Fund and its own corporate treasury.
Co-CEO Yi He said on Saturday that 50 percent of SAFU funds would be used, while the company said it was committing to replenishing the fund to return it to about $1 billion. Binance also said it had taken a new snapshot of assets held on its platform as of midnight GMT on October 31, as part of its proof-of-reserves process. For 10 major digital assets, including Bitcoin, Ethereum, Tether and XRP, Binance said it had secured reserves equivalent to 100 percent of customer holdings.
About $3 billion of the affected assets had been located as of Friday, as Binance worked with industry partners to freeze some of the stolen funds. The remaining amount, now less than 10 percent of the total, consists of assets that are less liquid and may take longer to source in the required amounts, according to the company.
Withdrawals Resume in Phases
Binance said it would resume withdrawals in phases after covering 95 percent of the stolen tokens. Phase one was scheduled to start between 0600 and 0900 GMT on Sunday, November 1, and to include Bitcoin, Ether, BNB, Solana, XRP, Dogecoin and other tokens. Withdrawals were not open as of 0250 GMT on Sunday, according to reports on the exchange’s status.
Co-CEO Richard Teng said on Friday that the breach was a complex attack involving a compromised laptop and malware designed to delete evidence of its activity, making it harder to trace and investigate. Binance has said the breach hit only its own hot wallet, an internet-connected wallet used to process withdrawals, and that customer funds were never used.
The episode is a stark test of cybersecurity defences at the largest crypto platforms. A single compromised device, if the company’s account is confirmed, was enough to open the door to a multi-billion-dollar theft that unfolded in roughly 20 minutes.
The FBI expects further laundering attempts, including through decentralised finance platforms, and has asked crypto firms to block suspect transactions.
Trump Sounds a Note of Caution
President Donald Trump, asked by reporters on Saturday night as he appeared at a Halloween party at his Mar-a-Lago estate in Florida, suggested investigators were not yet certain that North Korea was involved. He said his administration was investigating the hack, and added that it was not yet known whether North Korea was behind it.
The comment sits uneasily alongside the FBI statement issued the same day, and it underlines how politically sensitive an official attribution can be. The bureau’s statement was specific about the unit and the laundering pattern; the president’s remarks left the question open in public.
Why the Attribution Matters
An FBI attribution changes the shape of the response. It gives exchanges, banks and blockchain firms a formal basis for blocking addresses, and it raises the diplomatic stakes for a country already under heavy sanctions. It also puts other exchanges on notice: if a unit blamed for the Bybit theft can strike the world’s largest exchange, no platform can treat this kind of threat as theoretical.
- Record scale: $6.3 billion stolen, the largest crypto heist ever reported.
- Official blame: the FBI names North Korea’s TraderTraitor unit.
- Recovery so far: about $6 billion covered by Binance, about $3 billion located.
- Next risk: the FBI warns of further laundering through decentralised finance.
What to Watch Next
What happens next will be measured in three places: whether the phased resumption of withdrawals runs smoothly, whether the FBI’s blocked addresses actually slow the laundering, and whether Binance can replenish its SAFU fund to about $1 billion as promised. The company has said it is committed to covering the remaining amount, and the FBI has said it expects further laundering attempts. For now, the official blame is on the record, the money is mostly covered, and the chase for the rest of the stolen crypto is still under way.