The United States Federal Bureau of Investigation has formally blamed North Korea for the largest cryptocurrency theft in history, a $6.3 billion raid on Binance that unfolded in about 20 minutes on Thursday. In a statement issued on Saturday, October 31, the FBI named the state-sponsored hacking unit TraderTraitor as responsible, and warned exchanges worldwide that the stolen funds are already being laundered.
Binance, the world’s biggest cryptocurrency exchange, said on Sunday, November 1, that it has covered 95 percent of the stolen tokens and has begun restoring withdrawals in phases. That is the first concrete sign of recovery for users who watched funds freeze after the attack.
What the FBI said on Saturday
The FBI said it reached its conclusion together with partners at the US Secret Service and the criminal investigation division of the Internal Revenue Service. Its alert said TraderTraitor actors had been observed converting stolen assets primarily into Ethereum, the world’s second largest cryptocurrency.
Investigators expect the next stage to run through decentralised finance platforms and instant swap services, which let criminals move funds quickly between tokens and chains. The FBI published more than 600 suspect Ethereum addresses, just under 20 Bitcoin addresses and one Solana address, and urged exchanges to block transactions linked to them.
How $6.3 billion vanished in minutes
According to blockchain intelligence firm TRM Labs, the theft totalled about $6.36 billion in digital assets taken from Binance wallets across 10 blockchain networks. The bulk of it unfolded late on Thursday in around 20 minutes, a speed that points to careful preparation rather than opportunistic hacking.
Binance co-CEO Richard Teng has described the breach as a complex attack involving a compromised laptop belonging to a DevOps engineer, and malicious software designed to delete evidence of its activity. The attackers, in other words, did not simply guess a password. They appear to have worked their way inside the exchange’s own systems and then moved fast.
TraderTraitor is a subunit of the Lazarus Group, the North Korean hacking collective blamed for the $1.5 billion theft from Bybit in February 2025 and the roughly $620 million Ronin bridge theft in 2022. At $6.3 billion, the Binance raid is more than four times the size of the Bybit attack, which until now stood as the record.
Binance covers $6 billion and restarts withdrawals
Binance has repeatedly said it will bear the financial impact itself rather than pass losses on to customers. On Sunday it put numbers behind that promise, saying it had covered $6 billion of the stolen amount by using company money to buy replacement tokens, and had set aside around $6.34 billion of company funds internally.
Part of that money came from its $1 billion Secure Asset Fund for Users, known as SAFU, a Bitcoin reserve held to protect customers in emergencies, along with its Futures Insurance Fund and corporate treasury. Co-CEO Yi He said on Saturday that 50 percent of SAFU funds would be used, while the company committed to replenishing the fund back to about $1 billion.
The first phase of withdrawals began between 0600 and 0900 GMT on Sunday, covering 15 cryptoassets including Bitcoin, Ether, BNB, Solana, XRP and Dogecoin. The remaining 5 percent are less liquid assets that may take longer to source. About $3 billion had been located by Friday, with stablecoin issuers freezing more than $2.4 billion of it.
Why this case goes beyond crypto
The FBI attribution turns a corporate security failure into a geopolitical flashpoint. Pyongyang has for years denied using state-linked cyber units for theft and espionage, and US President Donald Trump said on Saturday that Washington was still not certain North Korea was involved. That caution, set against a formal FBI attribution, underlines how sensitive the evidence and the diplomacy remain.
For ordinary users, the practical lesson is urgent. Keep only trading funds on an exchange, move long-term holdings to a wallet you control, turn on every available security check, and treat any message offering to help recover hacked funds as a likely scam. Recovery comes through the exchange and law enforcement, not through a stranger in a chat group.
What happens next
Three tracks will now run in parallel. Binance must complete the remaining withdrawals without fresh disruption. Investigators must trace thousands of splitting transactions across chains before the trail goes cold. And governments must decide whether the FBI attribution leads to new sanctions or diplomatic pressure on Pyongyang. None of those tracks will be quick, but the Binance hack has already reset the scale of crypto crime.
FAQs
How much was stolen in the Binance hack?
About $6.3 billion in tokens, according to Binance and blockchain analysts. TRM Labs put the figure at $6.36 billion, making it the largest cryptocurrency theft on record.
Who does the FBI blame for the attack?
The FBI blamed TraderTraitor, a North Korean state-sponsored hacking unit and a subunit of the Lazarus Group, in a statement issued on Saturday, October 31.
Have Binance users lost their money?
Binance says no. It has covered $6 billion of the stolen amount from company funds and has begun restoring withdrawals in phases from Sunday, November 1.
Can the stolen crypto be recovered?
Partly, and slowly. About $3 billion had been located by Friday and stablecoin issuers froze more than $2.4 billion, but investigators warn the attackers are already laundering funds through swaps and decentralised platforms.
