FBI says North Korea behind US$6bil crypto theft from Binance

Binance said Sunday that it had resumed withdrawals after more than US$6 billion in virtual assets were stolen from the cryptocurrency exchange in a major hack the FBI said North Korea was responsible for.

Binance is the world’s largest crypto exchange by daily trading volumes. News of the hacking attack, which is thought to be the biggest-ever crypto heist, caused the prices of most major cryptocurrencies to fall sharply on Friday.

The company has offered reassurances that it will cover the losses from the attack, saying it has used company funds to buy tokens to replenish 90% of what was stolen.

Binance suspended user withdrawals after the attack but said they would be resumed in phases, the first of which began on Sunday.

“First batch network now opened in phase one of withdrawals,” the exchange posted on X .

The US law enforcement agency accused North Korea of being behind the hack in a statement on Saturday, confirming earlier suspicions from private investigators and analysts that a Pyongyang-affiliated group called TraderTraitor was responsible.

TraderTraitor is the same group blamed for a US$1.5 billion theft from the Bybit platform in February last year.

“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than US$6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about Oct 29, 2026,” the statement said.

The FBI added that it had observed “TraderTraitor actors” converting stolen assets into Ethereum, and expected those assets to be laundered further by converting them using decentralized finance and instant swap services.

It said it was urging private sector entities “to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.”

US president Donald Trump cast doubt on the North Korea’s involvement in the hack.

“I’m not concerned. We’re learning about it. We don’t know if it’s North Korea,” Trump told reporters at his residence in Florida late Saturday.

The president often reflects with pride on summits he held with North Korean leader Kim Jong Un during his first term.

Binance has said that it was preparing to gradually resume withdrawals, starting between 6am and 9am on Sunday.

“We are taking a phased approach by prioritising tokens based on the past week data of user demand, so that each network and asset pair can be restored carefully, with stability and security checks completed before access is reopened,” it said.

‘Cover the financial impact’

Binance said Saturday it has set aside more than US$6.34 billion in company funds to cover losses in the hack.

“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the company said on X.

It said it has used company money to buy tokens to replenish 90% of the stolen funds, while the remaining 10% of tokens are “less liquid, which means they may take longer to source in the required amounts”.

The attack on Binance came as many observers express worries that the ever-expanding capabilities of artificial intelligence models could compromise cryptography and IT security protocols.

Bitcoin plunged nearly 5% after the news of the hack, while Ethereum dropped nearly 6% and BNB, native to Binance, tumbled nearly 10%.

The sheer scale of the hack has put a spotlight on the capacity of North Korea – which faces extensive international sanctions over its nuclear and missile programs – to find illicit means to capture revenue.

TraderTraitor is believed to be part of the Lazarus Group, which gained notoriety in 2014 when it was accused of hacking into Sony Pictures as revenge for “The Interview”, a film that mocked North Korean leader Kim Jong Un.

Subscribe to our newsletter and get news delivered to your mailbox.