FBI says North Korea was responsible for the more than $6 billion theft from Binance

The US Federal Bureau of Investigation said on Saturday 31 October that North Korea was responsible for the theft of more than $6 billion in crypto assets from Binance, the world’s largest cryptocurrency exchange. Reuters had reported the FBI statement by 22:51 GMT on Saturday.

What the FBI said. “The FBI is releasing information advising the Democratic People’s Republic of Korea was responsible for the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026,” the agency said in a cyber alert, according to Yonhap and The Korea Herald. The FBI named the North Korean operation as “TraderTraitor”, a name previously used for North Korea-linked crypto thefts, according to Yonhap.

The FBI said it had observed the group converting the stolen assets mainly into Ethereum, working with the US Secret Service and the Internal Revenue Service’s Criminal Investigation division, Yonhap reported. It said it expected further laundering through decentralised finance platforms and exchange services that let users swap one digital asset for another quickly. The three agencies asked crypto exchanges, blockchain operators, analytics firms and other virtual asset service providers to block transactions involving the wallet addresses used to launder the funds, according to Yonhap.

AP reported that the FBI also tied the group to the $1.5 billion Bybit hack in February 2025.

What President Trump said before the FBI statement. On Friday 30 October, a day before the FBI statement, President Donald Trump was asked in the Oval Office whether the hack should be attributed to a North Korean hacking group. “We don’t know. We’re looking at that,” he said, according to The Hill, Bloomberg Law and Anadolu Agency; Bloomberg Law’s report was published at 21:00 GMT. A transcript of the remarks is on Trump Archive. Asked whether the money would be recovered, he said: “Well, they say they’re gonna get it back and they’re saying they’re guaranteeing it or something.” He added: “So I’ve always felt it was a little bit dangerous. But no, they say they have it pretty much under control. We’ll see.” The reports reviewed carried no further comment from Trump after the FBI statement.

Earlier attributions by analytics firms. The FBI’s statement followed assessments from two blockchain analytics firms. TRM Labs said it assessed with “high confidence” that TraderTraitor, which it describes as a subunit of North Korea’s Lazarus Group, was likely behind the hack, CoinDesk reported. TRM said several features matched earlier North Korea-linked thefts, including the Bybit and KelpDAO hacks, according to CNBC. TRM put the theft at an estimated $6.36 billion, per The Korea Herald.

Chainalysis said on its website that it attributes the hack to TraderTraitor, and that it announced its assessment at 04:30 GMT on 30 October. It said funds stolen from Binance had mixed on-chain with funds from last month’s Bitget theft, which had been attributed to North Korea. Chainalysis put the unauthorised transfers at about $6.4 billion. The investigator ZachXBT said on X that the attacker was “likely Lazarus”, CoinDesk reported.

Binance’s position. Binance has said about $6.3 billion in client assets was affected, according to CNBC. Binance co-CEO Richard Teng said on Friday that the investigation had not yet identified the attackers, NBC reported. The reports reviewed carried no Binance response to the FBI’s attribution. A person familiar with the matter told Reuters that Binance was working with law enforcement, including the FBI and the Secret Service.

On Saturday Binance said it had replenished about 90% of the stolen assets using company funds, part of its Secure Asset Fund for Users (SAFU) and part of its futures insurance fund, and had set aside about $6.34 billion of company funds. “Binance will absorb the financial impact of these stolen funds, not our users,” the exchange said, according to CNBC. CNBC noted that this refers to restored backing and not to funds recovered from the attacker.

User funds and withdrawals. Teng said on Friday that “your assets are safe” and that only Binance’s corporate holdings were targeted, NBC reported. Binance suspended withdrawals after the incident and said on Saturday that it was on track to reopen them on Sunday 1 November, subject to security checks. The reports reviewed, as of 00:57 GMT on Sunday, did not confirm that withdrawals had resumed. Binance said deposits have continued to work normally.

The reports reviewed carried no response from North Korea or from the South Korean government to the FBI’s statement. In its earlier report, Reuters said North Korea routinely denies involvement in crypto thefts.

For earlier coverage, see Binance’s update on covering 90% of the stolen assets and our first report on the suspected hack.