FBI Attributes Record $6.3 Billion Cryptocurrency Theft to North Korean Actors

FBI Attribution and Findings

The United States Federal Bureau of Investigation (FBI) has officially identified North Korean malicious actors as the perpetrators behind a record-breaking $6.3 billion cryptocurrency theft from the Binance exchange. The agency specifically pointed to the hacking group known as 'TraderTraitor,' an entity previously associated with a $1.5 billion heist involving the Bybit platform in February 2025.

According to an official FBI statement released on Saturday, the attackers have been observed laundering the stolen assets by converting them primarily into Ethereum. The agency warns that the funds are likely to undergo further laundering stages. To mitigate the impact, the FBI has issued a call for virtual asset service providers to monitor and block specific digital addresses identified as part of the laundering operation.

Operational Impact on Binance

Binance, the world’s largest cryptocurrency exchange, reported that the breach was the result of a 'complex attack' involving a compromised laptop and specialized malware designed to obscure the attackers' digital footprint. In response to the security incident, the exchange temporarily suspended customer withdrawals.

To protect its user base, Binance has implemented the following measures:

• Restitution: The exchange announced it has already replaced 90 percent of the stolen assets using internal company funds.
• Asset Recovery: Management confirmed plans to absorb the total financial impact, with the remaining 10 percent of illiquid tokens to be repurchased until the user pool is fully restored.
• Financial Backing: The recovery efforts are being funded through the company’s $1 billion Secure Asset Fund for Users (SAFU), its Futures Insurance Fund, and corporate treasury reserves.
• Proof of Reserves: To restore market confidence, the company has released a new proof-of-reserves snapshot, allowing users to verify that their holdings are backed at a minimum 1:1 ratio.

Market Context

The theft triggered a temporary downturn in cryptocurrency prices on Friday as stakeholders processed the scale of the breach. While Binance initially restricted access to funds, the company indicated that it was on track to resume standard withdrawal operations by Sunday.

Industry observers and users looking to verify the original status of these claims or monitor the ongoing investigation are encouraged to check official communication channels provided by the FBI and Binance’s verified corporate social media accounts for the latest security alerts and technical snapshots.