FBI Blames North Korea-Linked TraderTraitor for $6 Billion Binance Crypto Heist
The US Federal Bureau of Investigation has said that a North Korea-linked group was responsible for the theft of more than $6 billion in virtual assets from Binance, the world's largest cryptocurrency exchange by daily trading volumes.
In a statement released on Saturday, the FBI said the theft took place "on or about October 29" and was carried out by actors it refers to as TraderTraitor — the same group it has previously blamed for a $1.5 billion theft from the Bybit platform in February last year.
"The Federal Bureau of Investigation is releasing information advising that the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance," the statement said.
The agency said it had observed "TraderTraitor actors" converting the stolen assets into Ethereum, and expected them to be laundered further through decentralised finance platforms and instant swap services. It urged private sector entities "to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets."
If confirmed, the scale of the loss would make it the largest cryptocurrency theft recorded to date.
Binance says it will cover losses
Binance said on Saturday that it had set aside more than $6.34 billion in company funds to cover losses from the attack. "Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident," the company said in a post on X.
The exchange said it had used company money to buy tokens to replenish 90 per cent of the stolen funds. The remaining 10 per cent, it said, are "less liquid, which means they may take longer to source in the required amounts."
Binance suspended user withdrawals after the hack. In its latest update, the company said withdrawals were on track to resume on Sunday.
On Friday, Binance described the incident as a "complex attack" with several "points of breach" and said it was working to resolve it.
Markets fall, political doubt
News of the cyberattack caused the prices of most major cryptocurrencies to fall sharply. Bitcoin dropped nearly five per cent, Ethereum fell nearly six per cent, and BNB, the token native to Binance, tumbled nearly 10 per cent.
US President Donald Trump cast doubt on North Korea's involvement. "I'm not concerned. We're learning about it. We don't know if it's North Korea," he told reporters at his residence in Florida late on Saturday. The president has frequently spoken with pride about the summits he held with North Korean leader Kim Jong Un during his first term.
Why the case matters
The size of the alleged theft has drawn attention to the capacity of North Korea — which faces extensive international sanctions over its nuclear and missile programmes — to raise revenue through illicit means.
TraderTraitor is believed to be part of the Lazarus Group, a hacking operation that gained international notoriety in 2014 when it was accused of breaching Sony Pictures in apparent retaliation for "The Interview", a film that mocked the North Korean leader.
The attack also comes amid wider concern among security researchers that rapidly advancing artificial intelligence models could weaken cryptography and information-technology security protocols. Those concerns remain a matter of ongoing study and have not been formally linked to this incident.
The FBI has not released a full technical account of how the breach occurred, and Binance has not specified which systems were compromised. Investigations by US authorities and the exchange are reported to be continuing.
