N Korea behind US$6bn crypto theft, FBI says

BINANCE HACK ATTACK: US President Donald Trump cast doubt on Pyongyang’s involvement, saying: ‘We’re learning about it. We don’t know if it’s North Korea’

Binance Holdings Ltd (幣安) yesterday said that it had resumed withdrawals after more than US$6 billion in virtual assets were stolen from the cryptocurrency exchange in a major hack the FBI said North Korea was responsible for.

Binance is the world’s largest crypto exchange by daily trading volumes. News of the hacking attack, which is thought to be the biggest-ever crypto heist, caused the prices of most major cryptocurrencies to fall sharply on Friday.

The company has offered reassurances it would cover the losses from the attack, saying it has used company funds to buy tokens to replenish 90 percent of what was stolen.

The Binance logo and hacker code are pictured on Friday.

Photo: Reuters

Binance suspended user withdrawals after the attack, but said they would be resumed in phases, the first of which began yesterday.

“First batch network now opened in phase one of withdrawals,” the exchange posted on social media.

“We are taking a phased approach by prioritizing tokens based on the past week data of user demand, so that each network and asset pair can be restored carefully, with stability and security checks completed before access is reopened,” it said.

The US law enforcement agency on Saturday released a statement accusing North Korea of being behind the hack, confirming earlier suspicions from private investigators and analysts that a Pyongyang-affiliated group called TraderTraitor was responsible.

TraderTraitor is the same group blamed for a US$1.5 billion theft from the Bybit platform in February last year.

“The Federal Bureau of Investigation is releasing information advising the Democratic People’s Republic of Korea was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026,” the statement said.

The FBI added that it had observed “TraderTraitor actors” converting stolen assets into ethereum, and expected those assets to be laundered further by converting them using decentralized finance and instant swap services.

It said it was urging private sector entities “to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.”

The attack on Binance came as many observers express worries that the ever-expanding capabilities of artificial intelligence models could compromise cryptography and information technology security protocols.

The sheer scale of the hack has put a spotlight on the capacity of North Korea — which faces extensive international sanctions over its nuclear and missile programs — to find illicit means to capture revenue.

US President Donald Trump cast doubt on the North Korea’s involvement in the hack.

“I’m not concerned. We’re learning about it. We don’t know if it’s North Korea,” Trump on Saturday told reporters at his residence in Florida.

The US president often reflects with pride on summits he held with North Korean leader Kim Jong-un during his first term.