FBI Blames North Korean Hackers for Multibillion-Dollar Binance Theft

The FBI has accused a North Korean hacking operation of stealing more than $6 billion in cryptocurrency from Binance on October 29, in what is believed to be the largest theft of digital currencies in history. In a statement released Saturday, the bureau identified the operation responsible as TraderTraitor.

The FBI's cybersecurity alert attributed the attack to the Democratic People's Republic of Korea, North Korea's official name. Investigators working with the US Secret Service and the Internal Revenue Service's Criminal Investigation division said the hackers had started converting the stolen holdings into other cryptocurrencies, primarily Ethereum.

Blockchain intelligence company TRM Labs estimated that the attackers transferred approximately $6.36 billion out of Binance wallets across 10 blockchain networks. Most of those assets were moved within roughly 20 minutes during Thursday's attack. TRM Labs said it attributed the theft to TraderTraitor with high confidence.

US agencies warned that further laundering was expected through decentralized finance platforms and services that allow instant cryptocurrency exchanges. Such transfers could make the assets harder to track and recover. The alert highlighted concerns that the hackers could use decentralized transactions to conceal where the stolen funds originated and move them beyond investigators' reach.

To limit further transfers, the FBI asked cryptocurrency exchanges, blockchain infrastructure operators and other digital asset service providers to block transactions tied to wallets controlled by or closely associated with the hackers. Its appeal included THORNode operators, remote procedure call node operators, instant exchanges, decentralized finance services and blockchain analytics companies.

The bureau also released an extensive list of wallet addresses associated with the attack on networks including Ethereum, Bitcoin and Solana. According to the FBI, the listed addresses either still contained stolen assets or had held them earlier.

Binance said Saturday that it had replenished approximately 90% of the stolen cryptocurrency and allocated about $6.34 billion from company funds to absorb the losses. The exchange said it was collaborating with blockchain partners to locate affected assets and freeze them.

Withdrawals were suspended following the breach, with Binance saying it was working to restore service on Sunday. Co-CEO Richard Teng described a complex intrusion involving a compromised laptop and malware intended to remove evidence of the attack. The company has promised to cover customer losses using its corporate treasury and financial reserves while it works to resume normal operations.