North Korea was behind the theft of more than $6 billion in cryptocurrency from Binance, the FBI has confirmed. “The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, […]
North Korea was behind the theft of more than $6 billion in cryptocurrency from Binance, the FBI has confirmed.
“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026,” the bureau said in an alert published on October 31.
The FBI tied the attack to TraderTraitor, the North Korean group it named in the $1.5 billion Bybit hack of February 2025. Blockchain intelligence firms TRM Labs and Chainalysis were the first to attribute the heist to the group, within a day of the attack.
The FBI’s confirmation came as little surprise to anyone who follows crypto theft. For years, hackers working for the North Korean regime have been behind the most frequent and destructive attacks on cryptocurrency platforms.
By early October 2025, blockchain analytics firm Elliptic had linked more than $2 billion in stolen crypto to North Korea for that year alone, most of it from the Bybit heist, along with more than thirty other hacks. The money is believed to help fund the country’s nuclear weapons and missile programs.
Working with the US Secret Service and IRS Criminal Investigation, the FBI has seen the group convert the stolen assets mostly into Ethereum, and the agencies expect it to launder them further through DeFi platforms and instant swap services. They are urging node operators, instant exchanges, DeFi services, blockchain analytics firms and other crypto providers to block transactions linked to the 628 addresses listed in the alert, which include 608 Ethereum wallets, 19 Bitcoin wallets and one Solana wallet.
Binance co-founder Changpeng Zhao thanked the Secret Service and the other agencies and industry partners involved in the response. “You acted within minutes to help track and freeze stolen funds, and the work continues,” he wrote on X.
About $6.3 billion left Binance wallets on October 29, in what is likely the biggest crypto theft in history. The company first said the attacker may have gotten in through a compromised DevOps engineer’s laptop, which allowed access to a service container and unauthorized withdrawals, and later revealed its investigators had found further breaches.
Tether, Circle and other partners helped freeze close to $3 billion of the stolen funds within the first day.
Withdrawals return in phases
Binance began restoring withdrawals on November 1, with the first batch of networks and assets scheduled to open between 6 and 9 a.m. UTC. The exchange set the order based on user demand over the past week, so each network and asset pair can pass stability and security checks before it reopens.
Users should expect delays and slower processing while traffic is heavy, and Binance advises trying a failed withdrawal again after a short wait. Deposits have been running normally since early in the incident.
“Today, we’re beginning the phased resumption of withdrawals, taking a careful approach to ensure services return safely and securely,” co-CEO Richard Teng announced on X the same day.
“We understand the concern and disruption the suspension has caused. Restoring access to your funds is a priority, and we are taking a controlled approach to do so safely. We will continue to monitor closely as services return in phases,” the exchange told users in its latest Security Incident | Recovery Update.
Fiat withdrawals are returning as well. On November 2, Binance added the US dollar, UAE dirham, Vietnamese dong, Philippine peso and Indonesian rupiah to the list of currencies users can withdraw, bringing the total to 28, among them the euro, Japanese yen and Brazilian real.
The company has replaced about 95% of the stolen assets with its own money, up from 90% in its previous update. The remaining 5% consists of less liquid tokens outside the top ten assets, which Binance says take longer to buy at the scale it needs through market and OTC channels. Balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are backed 100%, and users can check this on the exchange’s proof of reserves site.
“Binance will absorb the financial impact of the stolen funds, not our users,” Teng added. A post-incident report will follow once the investigation wraps up.
Scammers exploit the withdrawal pause
Fraudsters were quick to take advantage of the incident. Fake posts and screenshots on social media claim Binance is paying a $150 compensation reward to users affected by the withdrawal suspension, and tell them to claim it through the Binance app.
“Some of you may have seen posts and screenshots circulating recently. Please be aware that these screenshots are fake and the information in them is false. For accurate and up-to-date information, always refer to our official channels and announcements,” warned Randy, a member of Binance’s global affiliates team, on X.
Zhao shared the warning with a short message to his followers. “Scammers on over drive now. Be careful.”
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
