FBI blames North Korea for $6 billion Binance theft, four times the Bybit hack it also tied to Pyongyang
Binance says it has covered 90% of the stolen assets and is reopening withdrawals. About $3 billion was frozen; the rest is being laundered.
The FBI said on Saturday that North Korea was responsible for stealing more than $6 billion in virtual assets from Binance, the world’s largest cryptocurrency exchange, on or about Oct. 29. It attributed the attack to a unit it calls TraderTraitor and said the hackers were converting stolen assets into Ethereum and were expected to launder them through decentralized-finance and instant-swap services.
Blockchain firm TRM says about $6.36 billion moved out of Binance wallets on ten blockchains, most of it in about 20 minutes.
Reported · TRM, via APThe FBI attributed the theft to North Korea’s TraderTraitor unit.
Reported · FBI statement quoted by Euronews and CNBC; full text not yet posted on IC3In February 2025, the FBI formally attributed the $1.5 billion Bybit theft to the same North Korean unit.
Confirmed · FBI public service announcementBinance says it has covered about 90% of the stolen assets and resumed withdrawals on the Bitcoin, Ethereum and BNB Smart Chain networks.
Reported · Binance statements, via CNBC
Confirmed = primary document · Reported = news reports or quoted statements · Suspected = one analyst or unnamed insiders · Disputed = reported and denied
North Korea’s weapons programs, if the unfrozen funds are converted; blockchain-tracing firms, whose work is now central to recovery.
Binance, which is paying from its user-protection fund, insurance fund and corporate treasury; exchanges facing tougher scrutiny of hot-wallet controls.
The number is not the whole story.
The dollar figure is the market value of tokens taken from Binance’s hot wallets, which are connected to the internet for withdrawals, at the time of the theft.
About $6.3 billion is roughly four times the $1.5 billion Bybit theft in February 2025, which the FBI also attributed to North Korea. About half of the Binance total has been frozen.
Frozen funds can be returned; laundered funds usually cannot. The share that escapes before tracing catches up is the real measure of what North Korea gains.
Verified baseline: FBI IC3 notice on the Bybit theft ↗ · AP report on frozen assets ↗
What came before?
The FBI attributed the $1.5 billion theft from the Bybit exchange in February 2025 to North Korea’s TraderTraitor unit. In 2022, South Korea’s spy agency estimated North Korean hackers had stolen about $1.1 billion in crypto over five years.
What is reported?
The Binance theft is about four times the size of Bybit. Roughly $3 billion was frozen with help from blockchain partners. Binance says its own internet-connected “hot wallet” was breached and that attackers used a self-destruct mechanism that slows the investigation.
What remains open?
Binance’s remaining 10% consists of less-liquid tokens it is still buying back. Investigators will track whether the unfrozen funds pass through mixers and swap services, as the FBI expects.
Check for the FBI’s posted notice with wallet addresses.
BACKGROUND3 dated sources · expand ↓
- The FBI issued a public notice attributing the $1.5 billion Bybit theft to North Korea and listing wallet addresses. FBI IC3 ↗
- Hackers drained Binance hot wallets; the exchange suspended deposits and withdrawals and began working with law enforcement. AP via PBS News ↗
- The FBI attributed the theft to North Korea as Binance reported covering about 90% of the stolen assets. Euronews ↗
What we'll check next: Check for the FBI’s posted notice with wallet addresses.
Why it matters
North Korea has turned to crypto theft to raise foreign currency under U.N. sanctions, according to experts cited by AP. Binance says it will absorb the losses, not its users, but the scale of the theft raises questions about how a single breach reached an internet-connected wallet holding billions.
What remains unresolved
How much of the roughly $3 billion that was not frozen can still be traced before it is laundered?
Sources are labeled by tier: Primary (documents and official data), Reporting (news organizations), Analysis (research and commentary). Attribution belongs to each named publisher.
Primary FBI Internet Crime Complaint Center — North Korea responsible for $1.5 billion Bybit hack (2025) ↗Reporting Euronews — FBI blames North Korea for Binance hack ↗Reporting Associated Press via PBS News — What to know about the Binance hack ↗Reporting CNBC — Binance resumes withdrawals ↗