FBI identifies North Korean hackers as responsible for unprecedented Binance breach

The Binance logo and hacker code are seen in this illustration taken Oct. 30, 2026. (Reuters/Yonhap)

The FBI said North Korea was responsible for the hacking of Binance, the world’s largest cryptocurrency exchange.

The hacking in question involved the theft of roughly US$6.3 billion in virtual assets, the largest amount in history. Analysts suggested North Korea is becoming bolder with its techniques of virtual asset hacking as a way of circumventing international sanctions.

On Saturday, the FBI stated that the attack on Binance on Thursday had been carried out by the North Korea-linked hacking organization TraderTraitor.

When asked about the Binance hack by reporters visiting his Mar-a-Lago residence in Florida the same day, US President Donald Trump said, “We don't know if it's North Korea, but if it is, we'll talk to North Korea about it.”

Last Friday, Binance announced that an incident had occurred a day earlier in which an engineer’s laptop was hacked, resulting in the illegal withdrawal of around US$6.3 billion in virtual assets.

With a subsequent investigation identifying additional breach points, the precise pathway of the attack had not yet been identified. Binance, an exchange where virtual assets such as bitcoin and Ethereum are traded, boasted more than 320 million users as of this year.

TraderTraitor, the North Korean organization identified as being behind the hack, has been tracked by the FBI and others since 2022. Its chief targets to date have been businesses linked to virtual assets. It has also been named as responsible for the February 2025 theft of around US$1.5 billion in virtual assets from Bybit, a different exchange.

Analysts suggested North Korea may have begun focusing its capabilities on cyberattacks targeting cryptocurrency over the past few years as global sanctions leave it facing difficulties with procuring foreign currency. The blockchain analysis firm Chainalysis estimated that North Korean-linked organizations were responsible for around 89% of global crypto hacking-related losses reported in 2026.

The Financial Times suggested that North Korean hackers have been bolder than their peers in other countries because they carry out their activities on behalf of the state, which means they do not have to fear punishment.

The Binance hack unfolded too quickly for authorities to take action against it.

A Binance cybersecurity team in Abu Dhabi first noticed the withdrawal of over US$1 billion in assets at 4:20 pm (EST) on Thursday. Within minutes, an emergency response team with members of the company’s leadership convened for a telephone conference, but there was nothing they could do. According to The Wall Street Journal, they could only watch in horror as the money slipped away. 

The losses swelled quickly to US$3 billion. By 4:40 pm — just 20 minutes after the attack was first spotted — they had exceeded US$6 billion.

The methods used to steal and launder the assets were also unprecedented. According to Chainalysis, the hackers used an automated program to generate thousands of transactions in a short time and diverted the funds between multiple wallet addresses or reverted them to previous addresses to complicate tracking.

When Binance and companies issuing stablecoins (virtual assets with values fixed to the dollar or other currencies) took measures to freeze the assets, the hackers quickly switched from stablecoins to Ethereum, which could not be frozen. The total of assets frozen to date stands at US$3 billion, or less than half the overall losses.

Binance announced that it had covered around 95% of the losses with its current emergency fund and company finances and that it was gradually resuming withdrawal services.

The New York Times observed that while crypto transactions are visible to the outside, the movements of funds are often faster than the exchange can respond, while the actual owners of the accounts can be difficult to determine. It also noted that the risk was being compounded by the hackers’ use of techniques involving advanced technologies such as artificial intelligence.