The FBI confirmed on Saturday that North Korean state-backed hackers were responsible for the $6.3 billion theft from Binance, the largest cryptocurrency heist in history. The bureau stated the attack was carried out by an entity known as TraderTraitor, which has been linked to previous major hacks, including a $1.5 billion theft from Bybit in 2025.
The FBI urged cryptocurrency exchanges and blockchain analytics firms to block transactions tied to identified addresses to prevent the stolen funds from being laundered. Investigators noted that TraderTraitor had begun converting stolen assets primarily into ethereum, with expectations that the group would attempt to move funds through DeFi platforms and instant swap services.
Binance, the world’s largest crypto exchange, announced it had already covered 90% of the stolen assets using company funds, including reserves from its $1 billion Secure Asset Fund for Users (SAFU) and corporate treasury. Co-CEO Richard Teng stated on X that users would not bear the financial impact of the incident. The exchange also confirmed it was reopening withdrawals on Sunday after halting them following the hack.
How the hack unfolded
Binance described the breach as a “complex attack” involving a compromised laptop and malicious software designed to delete evidence. The company later identified additional breaches and noted that forensic challenges had hampered the investigation. A snapshot of assets held on the platform was taken on October 31 as part of Binance’s proof-of-reserves process, ensuring transparency for users holding BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC.
Industry response and regulatory calls
Following the hack, crypto exchanges including Coinbase and Kraken moved to bolster their defenses, with Coinbase taking systems offline as a precaution. Analysts warned that the breach highlighted vulnerabilities in the sector as regulators push for deeper integration of digital assets into mainstream finance.
Sir Jon Cunliffe, former Bank of England Deputy Governor, called for “guard rails” to protect cryptocurrency in Britain, comparing the need for early regulation to the challenges faced by social media platforms. While he noted that Binance’s operations in the UK were limited, he emphasized the potential risks as crypto becomes more embedded in financial systems.
North Korea’s cyber operations
Cybersecurity firms TRM Labs and Chainalysis attributed the attack to North Korea’s state-backed Lazarus Group, citing “highly sophisticated and well-planned” tactics. The group has been linked to multiple cryptocurrency thefts, including the $100 million Atomic Wallet hack in 2022. Experts described the Binance heist as requiring months of planning, with hackers likely targeting a developer’s laptop to gain necessary approvals.
Financial and geopolitical implications
The stolen funds represent a significant revenue stream for North Korea, which has increasingly relied on cyberattacks to circumvent international sanctions. Analysts estimate that $3 billion of the stolen funds have been frozen, though North Korea may still profit from $2.4 billion if laundering efforts succeed. The hack has reignited debates over the effectiveness of sanctions and the role of cryptocurrency in funding rogue regimes.
Market reaction
Cryptocurrency prices declined following the hack, with Bitcoin falling over 4% and Ether dropping more than 5% on Thursday. Despite the turmoil, industry executives expressed confidence that Binance’s financial reserves would prevent broader financial contagion.