FBI Attributes Record $6.3 Billion Binance Hack to North Korean Hacking Group
The FBI says a North Korean state-backed unit known as TraderTraitor carried out the largest cryptocurrency theft in history, draining more than $6 billion from Binance. The exchange says customer funds are safe and it has already replaced most of the stolen assets.
The US Federal Bureau of Investigation has formally attributed this week's massive theft from cryptocurrency exchange Binance to a North Korean state-sponsored hacking unit, marking the largest crypto heist ever recorded. In a cyber alert issued on Saturday, the bureau named the group known as TraderTraitor as responsible for the breach, which it said involved more than $6 billion in virtual assets taken on or about October 29.
According to the FBI, the operation was carried out with support from the US Secret Service and the Internal Revenue Service's Criminal Investigation division. Investigators observed the hackers converting the stolen holdings primarily into Ethereum and expect the funds to be laundered further through decentralized finance platforms and instant crypto-swap services. The agencies have urged exchanges, blockchain operators, analytics firms and other virtual asset service providers to block transactions tied to the wallet addresses used in the attack.
Binance has moved to reassure customers, stating that users will not bear any financial loss. Co-CEO Richard Teng described the incident as a complex attack involving a compromised laptop and malicious software designed to erase evidence of its activity, which made the breach harder to trace. He said the exchange has already replenished about 90 percent of the stolen assets using its own funds and is committed to covering the remaining 10 percent, which consists of less liquid tokens that will take longer to buy back. Balances in major assets including Bitcoin, Ethereum, USDT, BNB, Solana, USDC, XRP and Zcash are reported to be fully backed.
The funds began leaving Binance's internet-connected hot wallets on the afternoon of October 29 US Eastern Time and moved across several blockchains within minutes, according to the account. Blockchain analytics firms TRM Labs and Chainalysis had already linked the breach to TraderTraitor, which is also associated with the Lazarus Group, before the FBI's public statement. Chainalysis noted that the stolen Binance funds were mixed on-chain with money taken in last month's Bitget hack, which has likewise been blamed on North Korea, and estimated that roughly $2.8 billion of the assets has been frozen.
The attribution adds to a growing record of large-scale crypto theft traced to North Korean operators. The same group is said to have been behind the $1.5 billion theft from the Bybit exchange last year, giving the country the dubious distinction of holding the record for both the largest and second-largest cryptocurrency hacks in history. The case also highlights the increasing scrutiny facing centralized exchanges and the cross-border tracing efforts used to recover stolen digital assets.
