A sweeping cyber theft targeting the world’s biggest cryptocurrency exchange has drawn a blunt accusation from US authorities: the FBI says North Korea was behind the loss of more than $6 billion in virtual assets from Binance, in what investigators believe is the largest crypto heist ever recorded.
The allegation landed as Binance sought to calm markets and customers, saying it is absorbing the damage from the hack and has already used company funds to buy tokens to replace 90% of what was taken.
Binance, which leads global crypto exchanges by daily trading volume, said the incident triggered sharp sell-offs across digital assets on Friday as news of the breach spread.
In its statement, the FBI said it was confirming assessments previously raised by private investigators and analysts that a North Korea-linked operation known as TraderTraitor carried out the attack.
TraderTraitor has been tied to major crypto thefts before, including a $1.5bn raid on the Bybit platform in February last year.
“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026,” the statement said.
The bureau said it had tracked “TraderTraitor actors” as they moved portions of the stolen holdings into Ethereum, and warned it expected further laundering through additional conversions using decentralised finance tools and instant swap services.
The FBI urged private-sector organisations “to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets”.
‘Cover the financial impact’
Binance said it has earmarked more than $6.34bn in company funds to make customers whole after the intrusion.
“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the company said on X.
According to Binance, it has already purchased tokens with company money to restore 90% of the missing assets. The final 10%, it said, involves tokens that are “less liquid, which means they may take longer to source in the required amounts”.
The exchange halted user withdrawals in the immediate aftermath of the attack, but said in its latest update that services were expected to resume today.
The Binance breach comes amid broader anxiety among security specialists that rapidly advancing artificial intelligence models could, over time, undermine cryptography and other IT security safeguards that underpin digital finance.
The scale of the hack has put a spotlight on North Korea
Market reaction was swift. Bitcoin fell nearly 5% after the report, Ethereum slid almost 6%, and BNB — Binance’s native token — sank close to 10%.
Binance said Friday it was still working through what it described as a “complex attack” involving multiple “points of breach”.
The enormity of the theft has renewed scrutiny of North Korea’s ability to generate funds through illicit channels as it remains under sweeping international sanctions tied to its nuclear and missile programs.
TraderTraitor is widely believed to operate within the Lazarus Group, which drew global attention in 2014 when it was accused of hacking Sony Pictures in retaliation for “The Interview”, a film that mocked North Korean leader Kim Jong Un.
