FBI Blames North Korea for $6.3 Billion Binance Crypto Theft
FBI Attributes Record Crypto Hack to North Korea
The FBI stated that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026. [1] The agency identified the state-sponsored unit TraderTraitor as the perpetrator in a cyber alert. [1] The FBI released the information advising that the Democratic People’s Republic of Korea carried out the theft from the world’s largest cryptocurrency exchange. [1] Analysts and the FBI both attributed the attack to North Korea. [4]
Binance Replenishes Most Stolen Assets
Binance said it has replaced 90 per cent of the amount stolen after the record US$6.3 billion hack by using company money to buy new tokens. [4] The exchange drew from part of its US$1 billion Secure Asset Fund for Users, some of its Futures Insurance Fund, and the company’s own corporate treasury. [4] Binance has set aside around US$6.34 billion of company funds internally to cover the losses. [4] Co-CEO Richard Teng stated that the exchange has now replenished 90 per cent of the stolen assets and is committed to covering the remaining 10 per cent. [4] Teng added that users will not bear the financial impact of this incident. [4] The remaining 10 per cent consists of tokens that are less liquid, meaning they may take longer to buy. [4]
Details of the Attack and Immediate Market Impact
The breach was described as a complex attack involving a compromised laptop and malicious software designed to delete evidence of its activity. [4] Crypto prices fell on Friday after the incident. [4] Binance temporarily stopped allowing customers to withdraw their funds following the hack. [4] The exchange said it was still on track to reopen withdrawals on Sunday. [4] Members of the TraderTraitor unit were observed converting stolen assets into the cryptocurrency ethereum. [4] The FBI expects further laundering of the assets through the use of related technology. [4]
Proof-of-Reserves and Asset Verification Steps
Binance took a new snapshot of assets held on its platform as of midnight on October 31 as part of its proof-of-reserves process. [4] Users holding the 10 listed tokens — BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC — would be able to verify that their assets were backed at a minimum ratio of 1:1 once the full proof was available. [4] The exchange used company funds to buy replacement tokens after the theft. [4]
Broader Context of North Korean Crypto Thefts
The FBI cyber alert addressed the theft of more than $6 billion in virtual assets from Binance. [1] The agency noted that the North Korean state-sponsored unit known as TraderTraitor carried out the attack. [4] Law enforcement observed the conversion of stolen assets into ethereum and anticipates further laundering activity. [4] The incident follows the pattern of state-sponsored activity described in the FBI statement. [1]
What to watch next: Binance plans to reopen withdrawals on Sunday while completing the proof-of-reserves verification for the listed tokens.
