After one of the largest known cryptocurrency thefts on record, Binance said it has resumed withdrawals as it works to recover from a hack that the FBI attributed to North Korea.
The US law enforcement agency issued its statement as Binance sought to calm markets and customers, insisting it is absorbing the damage from the attack and has already used company funds to buy tokens to replace 90% of the assets taken.
Binance, the world’s largest cryptocurrency exchange by daily trading volumes, found itself at the centre of a broad selloff on Friday as news of the breach rattled confidence across the sector and sent prices of major digital coins sharply lower.
The FBI’s findings echoed earlier assessments from private investigators and analysts, who had pointed to a North Korea-linked hacking outfit known as TraderTraitor.
TraderTraitor is the same group that investigators blamed for the $1.5bn theft from the Bybit platform in February last year.
“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026,” the statement said.
The FBI said it had seen “TraderTraitor actors” converting stolen holdings into Ethereum, and warned it expects additional laundering by shifting the funds through decentralised finance channels and instant swap services.
It said it was urging private sector entities “to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets”.
‘Cover the financial impact’
Binance said it has earmarked more than $6.34bn in company funds to cover losses tied to the hack.
“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the company said on X.
According to Binance, company money has already been used to purchase tokens restoring 90% of the stolen sum. The final 10%, it said, involves tokens that are “less liquid, which means they may take longer to source in the required amounts”.
The breach comes as growing numbers of observers warn that rapidly advancing artificial intelligence models could, over time, pose new challenges for cryptography and established IT security protocols.
The scale of the hack has put a spotlight on North Korea
Markets reacted swiftly. Bitcoin slid nearly 5% following the reports, Ethereum fell almost 6%, and BNB — Binance’s native token — dropped close to 10%.
Binance said on Friday it was still untangling what it described as a “complex attack” involving multiple “points of breach”.
The magnitude of the theft has also renewed attention on North Korea’s ability to generate revenue through illicit channels as it remains under sweeping international sanctions linked to its nuclear and missile programmes.
TraderTraitor is believed to be part of the Lazarus Group, which gained notoriety in 2014 when it was accused of hacking into Sony Pictures as revenge for “The Interview”, a film that mocked North Korean leader Kim Jong-un.
