FBI accuses North Korea of $6 billion Binance Crypto heist

WASHINGTON: The US Federal Bureau of Investigation (FBI) has accused North Korea of orchestrating a massive cyberattack that stole more than $6 billion in virtual assets from cryptocurrency giant Binance, in what authorities believe could be the largest cryptocurrency heist in history.

The FBI identified a North Korea-linked hacking group known as TraderTraitor as responsible for the attack, which reportedly took place on October 29, 2026. The disclosure has intensified concerns about cybersecurity risks in the rapidly expanding cryptocurrency industry.

In a statement released on Saturday, the FBI said its investigation had linked the theft to North Korean cyber actors and warned that the stolen digital assets were being moved through different cryptocurrency networks to conceal their origins.

According to the agency, investigators observed TraderTraitor members converting the stolen funds into Ethereum. The hackers were also expected to use decentralised finance platforms and instant cryptocurrency exchange services to launder the assets.

The FBI urged cryptocurrency businesses and other private-sector organisations to identify and block transactions connected to digital wallet addresses associated with the suspected hackers.

The group has previously been linked to another major cryptocurrency theft involving the Bybit platform, where approximately $1.5 billion was stolen in February 2025.

However, US President Donald Trump expressed uncertainty about North Korea’s alleged involvement, telling reporters in Florida that authorities were still examining the incident.

Meanwhile, Binance has assured customers that it will fully cover the financial losses resulting from the cyberattack.

The world’s largest cryptocurrency exchange by daily trading volume said it had allocated more than $6.34 billion in company funds to compensate for the stolen assets.

Binance also revealed that it had already purchased replacement tokens using its own resources, restoring approximately 90 per cent of the stolen funds. The remaining 10 per cent consists of less-liquid assets that may take additional time to obtain.

The exchange temporarily suspended user withdrawals following the incident but said services were expected to resume on Sunday.

The attack triggered widespread turbulence across cryptocurrency markets. Bitcoin dropped nearly five per cent, while Ethereum declined approximately six per cent. Binance’s native BNB token also suffered a sharp fall of nearly 10 per cent.

The incident has renewed international concerns about North Korea’s alleged use of sophisticated cyber operations to generate revenue despite extensive international sanctions.

TraderTraitor is believed to be associated with the notorious Lazarus Group, which has previously been accused of several high-profile cyberattacks, including the 2014 hacking of Sony Pictures.

The unprecedented theft has once again raised questions about the security of digital financial systems and the growing challenges facing cryptocurrency platforms.