FBI Blames North Korea’s TraderTraitor for $6.3 Billion Binance Hack — Binance Says 90% of Losses Covered

Washington, Nov 1, 2026 — The United States Federal Bureau of Investigation has formally blamed North Korea for the theft of more than $6 billion in cryptocurrency from Binance, the world’s largest crypto exchange, in what is now the biggest exchange hack on record. In a statement issued on Saturday, October 31, the FBI said the Democratic People’s Republic of Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026, and identified the attackers as TraderTraitor, a North Korean cyber operation previously blamed for major exchange thefts. Binance, meanwhile, says it has already replenished 90 per cent of what was stolen from company funds — and that its users will not bear the financial impact.

The attribution ends days of speculation that followed Thursday’s heist, in which roughly $6.3 billion in bitcoin and other digital currency was drained from Binance within minutes. Blockchain analysts had pointed at North Korea almost immediately; the FBI statement is the first official confirmation by US authorities, and it comes with a warning that the laundering of the stolen funds is already under way.

Key facts: FBI attributes the $6.3 billion Binance hack to North Korea

What the FBI actually said

The FBI’s statement was short and specific. It advised that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance, identified the operation as TraderTraitor, and said its investigators had observed TraderTraitor actors converting the stolen assets into Ethereum. The bureau warned that it expects the actors to attempt further laundering using decentralised finance platforms and instant swap services — the tools that let stolen crypto be moved and swapped without going through a regulated exchange.

Alongside the FBI, the US Secret Service and IRS Criminal Investigation joined the call for the crypto industry to act. The agencies urged exchanges, blockchain analytics firms, THORNode and RPC node operators, instant exchanges, decentralised finance services and other virtual asset service providers to block transactions linked to the flagged addresses. The FBI published a list of hundreds of addresses that currently hold, or at some point held, funds from the hack: more than 600 Ethereum addresses, just under 20 Bitcoin addresses and a single Solana address. Chainalysis, the blockchain analytics firm, expects tens of thousands of addresses to be used in the coming weeks as the laundering continues.

Why TraderTraitor, and why it matters

TraderTraitor is not a new name. It is the North Korean operation blamed for the $1.5 billion theft from the Bybit exchange — an attack the FBI also officially attributed to North Korea — and it is described as a subunit of the Lazarus Group, the North Korean hacking collective accused of a string of high-profile breaches, including the 2014 Sony Pictures hack. The Binance theft, at more than four times the Bybit amount, makes it the largest known hack of a digital asset exchange on record.

The attribution also followed an independent assessment. US blockchain intelligence firm TRM Labs had earlier attributed the estimated $6.36 billion Binance theft to TraderTraitor, noting that most of the funds were drained within roughly 20 minutes across multiple blockchain networks operated by Binance. The FBI statement confirms that private-sector assessment with law-enforcement authority — which is what turns an analyst’s suspicion into a basis for sanctions, seizures and international pressure.

What Binance says about user funds

Binance moved quickly to reassure customers. The exchange said on Saturday that it had set aside more than $6.34 billion in company funds to cover the losses, and that it had used company money to buy tokens to replenish 90 per cent of what was stolen. The remaining 10 per cent consists of tokens that are less liquid and may take longer to buy, the company said. Co-chief executive Richard Teng said on X that users would not bear the financial impact of the incident, adding: “We’ve now replenished 90% of the stolen assets, and we’re committed to covering the remaining 10%.”

Teng had said on Friday that the breach was a complex attack involving a compromised laptop and malicious software designed to delete evidence of its activity, making it harder to trace and investigate. Crypto prices fell on Friday as the scale of the theft became clear, while Binance sought to reassure customers that their funds were safe. US President Donald Trump, asked about the hack on Saturday, said “we’re learning about it” and added that his administration would “talk to North Korea about it.”

What happens next

Three tracks will now run in parallel. The first is the laundering race: whether exchanges and decentralised platforms block the flagged addresses fast enough to strand a meaningful share of the funds before they are swapped beyond recovery. The second is the diplomatic track: a formal US attribution against North Korea raises the stakes for any negotiation, and Trump’s comment suggests the hack will enter US–North Korea discussions directly. The third is the security reckoning for exchanges themselves: if the world’s largest exchange can lose $6.3 billion in about 20 minutes through a compromised laptop, every platform’s internal controls — not just its customer-facing security — will face fresh scrutiny.

For ordinary crypto users, the practical lesson is narrower and more useful: keep most holdings off exchanges where possible, treat any message, link or “support” contact that appears in the days after a major hack with extreme suspicion, and never send funds to an address claiming to “recover” stolen crypto. Binance says its users will not bear this loss — but the laundering wave that follows a hack of this size is exactly when impersonation scams spike.

Related reading: our technology coverage includes WhatsApp’s message scheduling rollout, the OnePlus 16 launch and its Pakistan pricing, and ColorOS 17’s global rollout schedule.

Frequently asked questions

By Fatima Raza | November 1, 2026