FBI Attributes Record $6 Billion Cryptocurrency Heist to North Korean Actors

Investigation Points to North Korean Cyber Activity

The United States Federal Bureau of Investigation (FBI) announced on Saturday that North Korea was responsible for the theft of more than $6 billion in virtual assets from the cryptocurrency exchange Binance. According to the law enforcement agency's statement, the incident occurred on or about October 29, 2026, and is widely reported to be the largest cryptocurrency heist in history.

The stolen funds comprised various digital assets, including bitcoin, ethereum, and stablecoins such as tether and USD Coin. The cyberattack prompted a market reaction, causing prices of major cryptocurrencies to decline on Friday.

Attribution and Laundering Concerns

The FBI stated that the breach was linked to malicious cyber activity conducted by an entity known as TraderTraitor—the same actor group previously associated with a $1.5 billion hack targeting the Bybit exchange in the prior year.

Investigators reported observing TraderTraitor actors converting the stolen funds primarily into ethereum. The FBI warned that these assets are expected to undergo further laundering stages using decentralized finance (DeFi) and instant swap services. In response, the agency has urged cryptocurrency exchanges and blockchain analytics firms to block transactions tied to specific addresses associated with the incident.

Binance Response and Platform Recovery

Binance, recognized as the world's largest cryptocurrency exchange by daily trading volumes, temporarily suspended withdrawals following the security breach.

• Asset Replenishment: On Saturday, Binance announced plans to utilize over $6.34 billion in company funds to purchase replacement tokens.
• Coverage Scope: The exchange stated this action would cover approximately 90% of the stolen assets, while less liquid tokens representing the remaining 10% would take longer to repurchase.
• Withdrawal Resumption: By Sunday, Binance began phasing the resumption of withdrawals, starting with an initial group of 15 cryptocurrencies, including bitcoin, ether, XRP, and dogecoin.

Public statements regarding the financial coverage were shared by the company on the social media platform X, where representatives reiterated that the platform intends to fully absorb the financial impact of the incident.

Verification and Practical Implications

Independent verification of the claims made by law enforcement and the exchange can be conducted by reviewing official statements published on the FBI's newsroom portal and Binance's official corporate channels and verified social media accounts. Stakeholders and users are advised to monitor blockchain analytics reports and exchange announcements for updates regarding address blacklists and withdrawal statuses.