FBI Blames North Korea for Binance Hack

The US Federal Bureau of Investigation (FBI) said on Saturday, October 31, that North Korea is responsible for the theft of virtual assets from the Binance exchange. Private investigators and analysts had reached the same conclusion earlier, but this is the first time a government agency has put its name to it. We covered the attack on Binance in an earlier article, and this is its sequel: the question of “who” now has an official answer, but the American president has not confirmed it.

According to the FBI, assets worth about $6.3 billion disappeared around October 29, 2026. The agency’s own statement says “more than $6 billion,” while the figure of $6.3 billion comes from reports on the hack. It is the largest crypto theft to date.

What exactly did the FBI say?

The agency attributed the attack to a group called TraderTraitor. The statement reads:

“The Federal Bureau of Investigation (FBI) is releasing information announcing that the Democratic People’s Republic of Korea (North Korea) is responsible for the theft of virtual assets worth more than $6 billion from the Binance cryptocurrency exchange around October 29, 2026.”

The same group is blamed for the theft of $1.5 billion from the Bybit platform in February last year. The FBI does not treat it as a separate entity: TraderTraitor is considered part of the Lazarus group, which gained notoriety in 2014, when it was accused of breaking into the computers of Sony Pictures in revenge for the film “The Interview,” which mocked North Korean leader Kim Jong Un. North Korea is under extensive international sanctions over its nuclear and missile programs, so the case reopens the question of how Pyongyang finds revenue outside them.

How is the stolen money being laundered?

The FBI says the stolen assets have been converted mostly into Ethereum and will be laundered further in stages, through decentralized finance and instant cryptocurrency swap services. The agency therefore called on virtual asset service providers to block transactions from the addresses the group uses, and it published those addresses.

What do Trump and Binance say?

President Donald Trump, speaking to reporters late on Saturday at his residence in Florida, questioned the conclusion of his own agency:

“I’m not worried. We’re finding out about it. We don’t know if it’s North Korea.”

Trump met with Kim Jong Un during his first term and often speaks about those meetings with pride.

Binance says its users will not bear the loss. The company said on X: “Binance will bear the financial hit from these stolen funds, not our users.” It set aside more than $6.34 billion of its own funds and has already made up 90 percent of the stolen amount by buying tokens. The money came from the SAFU fund of $1 billion, which is part of the futures insurance fund, and from the corporate treasury. The remaining 10 percent is made up of less liquid tokens, which take longer to acquire.

The company’s co-owner Richard Teng said on Friday that it was a “sophisticated attack” that used an infected laptop and malware designed to erase its tracks, which makes the investigation harder. After the attack Binance halted withdrawals, and on Sunday it began restoring them in stages, first between 6 and 9 a.m. GMT, based on user demand over the past week. The company also published a new snapshot of its reserves, which lets users check for themselves that funds are covered at a ratio of at least 1:1.

Prices fell as early as Friday, after the first news of the attack: bitcoin by almost 5 percent, Ethereum by almost 6, and BNB, the token tied to Binance, by almost 10 percent.