The FBI has formally blamed North Korea for the theft of roughly $6.3 billion in cryptocurrency from Binance, calling the world’s largest crypto exchange hack the work of a North Korean state-sponsored unit it identifies as TraderTraitor.
In a statement Saturday, the bureau said the group carried out the heist and has been observed converting the stolen assets, mostly into Ether. It warned the funds are expected to move through decentralized-finance and instant-swap services as the laundering effort advances, and urged exchanges, node operators and crypto firms to block transactions tied to the listed wallet addresses.
The theft unfolded late Thursday in the span of about 20 minutes, according to blockchain analysis firms TRM Labs and Chainalysis, which estimated the total taken at $6.36 billion to $6.43 billion across ten or eleven blockchains. Analysts have called it the largest digital heist on record — roughly four times the roughly $1.5 billion the same group is blamed for stealing from the Bybit exchange in February 2025.
President Donald Trump struck a more cautious note Saturday, saying U.S. investigators were still not certain North Korea was behind the attack. “We don’t know if it’s North Korea — but if it is, we’ll talk to North Korea about it,” he said, according to Reuters.
Binance, meanwhile, began letting customers withdraw again on Sunday, three days after attackers emptied its hot-wallet infrastructure. The exchange said it had covered 95 percent of the stolen tokens using about $6.34 billion of company money, drawn from its $1 billion Secure Asset Fund for Users, its Futures Insurance Fund and its corporate treasury. The first phase of withdrawals began shortly after 0600 GMT Sunday with 15 cryptoassets, including bitcoin, ether, XRP and dogecoin.
About $3 billion of the stolen assets had been frozen as of Friday, the company said, with the remaining 5 percent consisting of less-liquid tokens that may take longer to source.
For ordinary users, the message is that Binance says customers will be made whole from company funds rather than their own deposits — though the attack has renewed scrutiny of how much cryptocurrency exchanges hold in vulnerable hot wallets, and of crypto theft as a funding stream for Pyongyang’s weapons programs.
What to watch next
Investigators are still examining how the attackers got in. Binance first said a compromised employee laptop may have opened access to an internal withdrawal service, and later reported additional breach points — while saying it found no evidence that wallet private keys were exposed. The company has promised a fuller technical account after its investigation.
Sources: Reuters, Cointelegraph.
