FBI Says North Korean Hackers Conducted $6.3B Crypto Heist on Binance

The FBI has confirmed that North Korea was responsible for stealing crypto worth over $6 billion from crypto exchange Binance, corroborating earlier findings by blockchain intelligence firms.

In an alert issued Oct. 31, the FBI stated that North Korea was responsible for the Oct. 29 attack. Investigators identified the perpetrators as TraderTraitor, the same North Korean-linked operation previously blamed for the Bybit breach in February last year.

Blockchain research companies Chainalysis and TRM Labs had reached the same conclusion within 24 hours of the Binance incident.

North Korean hackers have been repeatedly linked to some of the crypto industry’s largest thefts. Elliptic reported in October 2025 that it had connected over $2 billion in digital assets stolen that year to North Korean actors. Much of that amount came from the Bybit attack, alongside proceeds from more than 30 additional incidents. Security experts have long warned that stolen crypto helps support Pyongyang’s weapons development programs.

The FBI, working with IRS Criminal Investigation and the U.S. Secret Service, said the stolen holdings have largely been converted into Ether (ETH). Authorities expect the attackers to continue moving the assets through rapid swap platforms and decentralized finance services. They have asked crypto businesses to block activity associated with 628 addresses identified in the attack. The list contains 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address.

Roughly $6.3 billion in assets reportedly moved from Binance wallets during the breach, potentially making it the largest crypto theft ever recorded. Binance initially suspected that an attacker had gained access through a compromised laptop belonging to a DevOps employee, although subsequent investigation uncovered additional security breaches.

Several industry partners, including Tether and Circle, helped freeze nearly $3 billion within the first 24 hours.

Binance started restoring withdrawals on Nov. 1 in stages, prioritizing networks according to recent customer demand while conducting security and stability checks. The exchange cautioned that heavy traffic could cause delays and advised users to retry unsuccessful transactions after waiting briefly. Deposits remained operational.

The company also stated that it had replaced approximately 95% of the lost assets using its own funds, with less liquid assets accounting for the remaining portion. Binance said users would not bear the financial loss.

Fiat withdrawals resumed as well, with several currencies added to the available list on Nov. 2.

Meanwhile, scammers have circulated fabricated social media posts claiming Binance is offering users a $150 compensation payment. The exchange urged customers to rely only on official announcements.

Binance co-founder Changpeng Zhao also warned followers about the fraudulent claims, urging users to remain cautious as scammers exploit confusion surrounding the incident.

The way hackers are becoming emboldened to undertake larger heists is likely making digital asset companies like Canaan Inc. (NASDAQ: CAN) more concerned about their cybersecurity systems since even major exchanges like Binance have fallen victim to these cartels.

About CryptoCurrencyWire

CryptoCurrencyWire (“CCW”) is a specialized communications platform with a focus on blockchain and the cryptocurrency sector. It is one of 75+ brands within the Dynamic Brand Portfolio @ IBN that delivers: (1) access to a vast network of wire solutions via InvestorWire to efficiently and effectively reach a myriad of target markets, demographics and diverse industries; (2) article and editorial syndication to 5,000+ outlets; (3) enhanced press release enhancement to ensure maximum impact; (4) social media distribution via IBN to millions of social media followers; and (5) a full array of tailored corporate communications solutions. With broad reach and a seasoned team of contributing journalists and writers, CCW is uniquely positioned to best serve private and public companies that want to reach a wide audience of investors, influencers, consumers, journalists and the general public. By cutting through the overload of information in today’s market, CCW brings its clients unparalleled recognition and brand awareness. CCW is where breaking news, insightful content and actionable information converge.

To receive SMS alerts from CryptoCurrencyWire, text “CRYPTO” to 888-902-4192 (U.S. Mobile Phones Only)

For more information, please visit https://www.CryptoCurrencyWire.com

Please see full terms of use and disclaimers on the CryptoCurrencyWire website applicable to all content provided by CCW, wherever published or re-published: https://www.CryptoCurrencyWire.com/Disclaimer

CryptoCurrencyWire
Austin, Texas
www.CryptoCurrencyWire.com
512.354.7000 Office
Editor@CryptoCurrencyWire.com

CryptoCurrencyWire is powered by IBN