FBI blames North Korea for $6.3B Binance crypto hack

The FBI said on Saturday, October 31, that North Korea carried out the theft of more than $6 billion in cryptocurrency from Binance. U.S. officials have now formally backed what blockchain analysts had said for two days, that the largest crypto heist on record was the work of Pyongyang's state-backed hackers. According to Channel NewsAsia, the bureau named the unit known as TraderTraitor. The FBI has said the same group was responsible for the $1.5 billion Bybit hack in February 2025.channelnewsasia.com+1

"The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum ↘ 0.18%," the bureau said in a statement reported by Bloomberg. It added that it expects further laundering through DeFi and instant swap services. NewsNation Nexstar Media Group, Inc. ↗ 0.79% reported that the FBI also published crypto addresses linked to the theft and asked the public for information.newsnationnow.com+1

Twenty minutes, $6.3 billion

The attack started at 4:05 p.m. Eastern on Thursday, October 29. Hackers took just over $6.3 billion in about 20 minutes, NPR reported. TRM Labs put the total at $6.36 billion, moved across ten blockchains. Co-CEO Richard Teng called it a "complex attack" that involved a compromised laptop and malware built to erase its own traces. He said the attackers manipulated a transaction approval system to drain an internet-connected "hot" wallet without going through normal controls, Reuters reported.npr.org+2

TRM and Chainalysis had already tied the attack to TraderTraitor "with high confidence," AP reported. Earlier, the FBI had said only that it was "aware of the incident," Nextgov/FCW reported. North Korea has denied similar accusations in the past, according to Reuters.newsobserver.com+2

Freezes and repayment

Binance and its partners have frozen about $3 billion of the stolen assets, NPR reported. Tether froze nearly $1.57 billion, and Circle ↘ 9.31% froze more than $800 million, Reuters reported. Ripple and World Liberty Financial froze tokens as well. Stablecoin issuers can lock tokens held at specific addresses, but the attackers still turned about $786 million into assets that are harder to trace, Elliptic told Business Insider.africa.businessinsider.com+2

On Saturday, Binance said it had used company money to buy new tokens and replace 90% of the stolen funds, Channel NewsAsia reported. The exchange plans to restart withdrawals on Sunday, November 1, according to Business Insider. Crypto prices fell after the hack became public, Reuters reported, and Bitcoin ↘ 0.38% was among the coins that declined.newsobserver.com+2

Weapons concerns

Analysts warn that the money could pay for North Korea's weapons programs. "This isn't just a commercial hacker who's looking to make some money," TRM's Ari Redbord told NPR. "This is going to be used for weapons proliferation and other destabilizing activity."npr.org