FBI Blames North Korea for Record $6.3 Billion Binance Hack

The FBI has attributed the $6.3 billion theft from Binance to North Korea, identifying a state-backed hacking operation behind the biggest cryptocurrency heist on record.

The bureau’s statement on Saturday marked the first official confirmation of Pyongyang’s involvement.

It named TraderTraitor, the North Korean unit previously blamed for stealing $1.5 billion from Bybit in February 2025.

Binance, the world’s largest cryptocurrency exchange, said it had covered roughly 90% of the stolen amount and was targeting Sunday to reopen withdrawals.

It reiterated that it would reimburse customers in full.

Following the Stolen Funds

Investigators are tracking the movement of the assets as the hackers prepare to obscure their origin.

“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum,” the bureau said, referring to the U.S. Secret Service and the Internal Revenue Service’s criminal investigation division.

The FBI expects the group to move the funds through decentralized finance platforms and instant swap services in subsequent laundering stages.

Crypto research firms said the operation involved laundering patterns they had not previously encountered.

How the attackers gained access remains under investigation.

Binance initially pointed to a potentially compromised engineer’s laptop, before reporting on Friday that it had found “additional points of breach.”

A Larger Successor to Bybit

The Binance theft exceeds the previous record set by the Bybit attack, which the FBI also attributed to North Korean hackers.

In that operation, attackers exploited Bybit’s dependence on a free software product and deceived chief executive Ben Zhou into approving what appeared to be an ordinary transaction.

The approval gave them control of the exchange’s system.

The stolen assets were subsequently dispersed across numerous cryptocurrency wallets, a technique North Korean hackers had used in earlier thefts.

U.S. authorities also accused the Lazarus Group of taking about $620 million in cryptocurrency from the video game Axie Infinity in 2022.

The FBI has described Lazarus and TraderTraitor as fronts for the same regime-backed hackers.

Revenue for Pyongyang

The attacks have become a substantial source of income for the heavily sanctioned state.

A U.N. panel found in 2024 that cyberattacks accounted for about half of North Korea’s foreign currency earnings.

Security officials have warned that the proceeds help finance its military and nuclear weapons program.

President Donald Trump said Friday that Washington was examining possible North Korean involvement in the Binance breach. The FBI attributed it a day later.

Trump has recently raised the possibility of renewed contact with North Korean leader Kim Jong Un, although he subsequently tempered expectations of a meeting this year.