Federal Bureau of Investigation (FBI) has formally attributed a record-breaking $6.3 billion cryptocurrency theft from Binance, the world’s largest digital asset exchange, to a North Korean state-sponsored hacking unit. It confirms earlier assessments from leading blockchain intelligence firms and marks the largest crypto heist in history.
The attack unfolded in the early hours of 29 October, 2026, when unauthorised transactions began draining funds from Binance’s hot wallets across ten separate blockchains.
According to TRM Labs, the majority of the stolen assets were moved within a span of roughly 20 minutes, a level of speed and coordination that analysts described as unprecedented. The total loss was valued at approximately $6.3 billion at the time of the theft.
Previously, the biggest crypto heist was the Bybit hack that happened in February 2025. The estimated loss in that heist was $1.5 billion.
The FBI’s Saturday statement identified the hackers as “TraderTraitor,” a cyber operation widely known to be part of North Korea’s broader Lazarus Group hacking apparatus. The bureau said it had observed the hackers converting stolen assets primarily into Ethereum and warned that they would likely continue laundering the funds through decentralised finance platforms and crypto exchanges.
The FBI is coordinating with the U.S. Secret Service and the IRS Criminal Investigation Division to track and recover the assets. The attribution follows high-confidence assessments from TRM Labs and Chainalysis, both of which pointed to TraderTraitor based on blockchain transaction patterns and external intelligence.
Binance’s preliminary investigation suggests the breach originated not from a flaw in its core wallet architecture but from the compromised laptop of a development and operations engineer. According to the company, attackers used that access to reach internal service execution environments and request unauthorised withdrawals.
Binance emphasised that it had found no evidence that private keys were leaked. The exchange has since frozen approximately $3 billion of the stolen funds, with Tether blocking roughly $1.6 billion and Circle freezing over $800 million in USDC. Binance has pledged to cover all user losses through its Secure Asset Fund for Users (SAFU) and corporate reserves.
The disclosure sent immediate shockwaves through cryptocurrency markets. Bitcoin briefly fell more than 3 per cent, dipping below $ 77,000, which is its lowest level since September, while Ethereum also declined. The volume of forced liquidations reached an estimated $1.5 billion, with the majority hitting long positions. Analysts noted that the sheer scale of the Binance breach poses a systemic confidence risk for the entire industry, given the exchange’s dominant role in global crypto trading.
The incident underscores North Korea’s escalating reliance on cybercrime as a revenue source. According to TRM Labs, North Korean-linked groups stole approximately $2.02 billion in cryptocurrency during 2025 alone, and the Binance haul now stands as the single largest state-sponsored crypto theft ever recorded.
Binance has covered 95% of the stolen assets using its own corporate funds, with the remaining 5% consisting of less liquid tokens that are still being sourced through market and over-the-counter channels. The exchange confirmed that the top ten tokens, including BTC, ETH, USDT, BNB, SOL, USDC, XRP, and ZEC, are now 100% fully backed. Co-CEO Richard Teng stated that users will not bear any financial losses from the incident.
The replenishment drew from three sources: a partial deployment of the Secure Asset Fund for Users (SAFU), a portion of the Futures insurance fund, and Binance’s corporate treasury. Binance has committed to restoring SAFU to approximately US$1 billion. A new Proof of Reserve snapshot was taken on 31 October, with full zero-knowledge proof verification expected by Tuesday, 3 November.
Withdrawals resumed in phases on Sunday, 1 November, between 0600 and 0900 GMT. Former Binance CEO Changpeng Zhao credited the FBI, U.S. Secret Service, and IRS for assisting with tracking and freezing stolen funds, noting their work was a key reason Bitcoin did not decline further. The FBI has warned that TraderTraitor is converting stolen assets primarily into Ethereum and is expected to attempt further laundering through DeFi platforms and instant swap services.
