The FBI says North Korea is responsible for stealing more than $6 billion in virtual assets from Binance, the world's largest crypto exchange, in a theft that occurred on or about Oct. 29 — and if the attribution holds, it would mean a hostile regime just helped itself to the biggest crypto heist on record while Washington debates how to respond.
The FBI announced the attribution on Saturday, Oct. 31, saying North Korean cyber activity it tracks as TraderTraitor was behind the theft. The bureau says it worked with the U.S. Secret Service and IRS Criminal Investigation, and that investigators have watched TraderTraitor actors converting the stolen assets primarily into Ether. The FBI says it expects the assets will then be further laundered through decentralized finance, or DeFi, and instant swap services. Federal agencies are urging private firms to block transactions with, or derived from, addresses the hackers are using. The alert names THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers, and it lists wallet addresses the FBI says are operated by or closely connected to TraderTraitor actors. Binance halted customer withdrawals after the theft. On Saturday, the company said it had replaced 90% of the stolen amount with company money to buy new tokens, and that it had set aside about $6.34 billion of company funds internally to cover losses. It said it was on track to reopen withdrawals Sunday, Nov. 1, and had taken a new proof-of-reserves snapshot as of midnight GMT Saturday. Binance co-CEO Richard Teng has said users will not bear any losses. Figures vary by outlet: some use $6.3 billion, while the FBI's wording is simply more than $6 billion.
The FBI expects the stolen assets will be moved through DeFi and instant swap services, and it wants private firms to block the addresses now being used to launder them.
This is not TraderTraitor's first headline. The FBI blamed the same operation for the roughly $1.5 billion theft from the exchange Bybit in February 2025, and it asked platforms to block listed addresses then as well. Researchers at The Hacker News say this new theft, at $6.43 billion, surpasses the $1.46 billion Bybit heist as the largest in crypto history, and that $2.85 billion of the stolen assets have been frozen on-chain by Tether, Circle, Ripple, Arbitrum and Optimism. The Diplomat says North Korea stole at least $2.84 billion in crypto from January 2024 to September 2025, with TraderTraitor accounting for about $2.58 billion. It says thefts in 2024 alone totaled at least $1.19 billion, roughly one-third of the country's foreign currency earnings that year, citing a monitoring team. The group is also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899, and uses recruitment-themed lures to trick victims into running malicious code. North Korea has denied involvement. Kim Yo Jong, sister of leader Kim Jong Un, called the FBI announcement “a trite provocation” and “an absurd rhetoric,” according to NBC's account of her statement. President Trump told reporters in Florida on Oct. 31 that his administration was examining whether North Korea was responsible.
Crypto enthusiasts will say that a hack of a private exchange is a private problem, and they have a point: Binance, not taxpayers, is covering the losses. But a theft this size is not ordinary crime. If the FBI is right, it is a hostile government funding itself by robbing the financial system, and the money flows toward a regime that spends heavily on weapons. Sanctions that do not touch the laundering routes are a press release, not a policy. The practical lesson is accountability. Exchanges that hold billions in customer assets should be held to security standards that match the stakes, and the firms that move laundered funds, from instant swap services to DeFi platforms, should not treat blocking known criminal addresses as optional. Washington should also be consistent. The same operation hit Bybit in 2025, and the playbook has not changed. Repeating the same warnings after each heist, while the sums grow, is not deterrence. It is a habit.
The word attribution matters here. The FBI says North Korea is responsible, but no individuals have been named or charged in the public alert, and Pyongyang denies involvement. Fox Business says this is the first public confirmation from U.S. federal investigators of North Korea's role, following earlier assessments by private cybersecurity researchers. Also note what the dollar figure measures: it is the value of assets taken, and crypto prices move. NBC says prices fell Friday, so the number can shift with the market. Binance also says it has covered losses, which means customers are not out the money even though the theft itself remains real.
Source:North Korea responsible for $6 billion Binance cryptocurrency hack, FBI says
Think of a bank vault that gets emptied, then quietly refilled by the bank's own owners before most customers notice. The lights are back on, the doors reopen, and everyone moves on. But the thief is still out there, spending. Binance says it made its customers whole, and that is good news for them. The harder question is who makes the thieves pay. Eleven digits of stolen value are now being swapped, split and hidden across the internet, and the clock favors the launderers. Block the addresses, harden the exchanges, and stop treating a state-sponsored bank robbery as a technology story. It is a national security story.