The United States Federal Bureau of Investigation (FBI) has accused North Korea of stealing more than $6 billion in cryptocurrency from Binance, the world’s largest cryptocurrency exchange by daily trading volume.
The agency said on Saturday that a North Korea-linked hacking group known as TraderTraitor was responsible for the attack, which is believed to be the biggest cryptocurrency theft on record.
The FBI’s announcement confirmed earlier suspicions by private investigators and cybersecurity analysts about the group’s involvement in the October 29, 2026, attack.
In a statement, the agency said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance.
It added that investigators had observed TraderTraitor actors converting the stolen assets into Ethereum, with plans to move the funds through decentralised finance platforms and instant cryptocurrency swap services.
The FBI urged cryptocurrency businesses and other private-sector organisations to block transactions involving wallet addresses linked to the stolen funds.
Binance Moves to Replenish Stolen Funds
Binance said it had set aside more than $6.34 billion in company funds to cover the financial impact of the attack.
The exchange also disclosed that it had used its own funds to purchase tokens, replenishing about 90 per cent of the stolen assets.
“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the company said in a statement posted on X.
It explained that the remaining 10 per cent involved less-liquid tokens, which could take longer to source in the required quantities.
Binance had temporarily suspended user withdrawals following the attack but said it expected withdrawals to resume on Sunday.
Cryptocurrency Prices Fall After Attack
News of the cyberattack triggered a decline in the prices of major cryptocurrencies on Friday.
Bitcoin fell by nearly five per cent, while Ethereum dropped about six per cent. Binance’s native token, BNB, also lost nearly 10 per cent.
The incident has renewed concerns about the security of cryptocurrency platforms, particularly as cybercriminal groups explore increasingly sophisticated hacking methods.
It has also raised questions about the potential risks posed by advances in artificial intelligence to existing cryptographic and information technology security systems.
North Korea-Linked Group Under Scrutiny
The FBI identified TraderTraitor as the group responsible for the attack and said it was linked to North Korea.
The group has also been accused of stealing $1.5 billion from cryptocurrency exchange Bybit in February 2025.
TraderTraitor is believed to be part of the Lazarus Group, a hacking network accused of carrying out several major cyberattacks.
Lazarus gained international attention in 2014 after being accused of hacking Sony Pictures Entertainment in an attack linked to the release of The Interview, a film that mocked North Korean leader Kim Jong Un.
North Korea, which faces extensive international sanctions over its nuclear and missile programmes, has repeatedly been linked by international investigators to cyber operations targeting financial institutions and cryptocurrency platforms.
