FBI Attributes Record $6.3 Billion Binance Hack to North Korea

The Federal Bureau of Investigation has attributed a record-breaking $6.36 billion cryptocurrency theft from Binance to TraderTraitor, an elite North Korean state-sponsored hacking unit. The breach, which occurred on October 29, 2026, saw billions in assets drained across ten blockchains in approximately 20 minutes. Investigators found that attackers compromised a DevOps engineer's laptop to gain access to service containers and bypass transaction-approval systems, though Binance later noted the attack involved more complex vulnerability vectors.

In response, Binance suspended all deposits and withdrawals for three days. The exchange collaborated with partners including Tether and Circle to freeze approximately $3 billion in stolen assets. To protect users, Binance committed over $6.34 billion from its corporate treasury, Futures Insurance Fund, and Secure Asset Fund for Users (SAFU) to cover all losses. By November 1, the company reported it had replaced between 90% and 95% of the stolen assets.

Phased withdrawals resumed on November 1, triggering an initial net outflow of approximately $3.64 billion. While the FBI and blockchain firms TRM Labs and Chainalysis expressed high confidence in North Korean responsibility, President Donald Trump questioned the certainty of these findings, though he stated the U.S. would engage in talks with Pyongyang if involvement is confirmed.

The incident triggered a market downturn, sending Bitcoin to multi-week lows, though prices stabilized as Binance guaranteed user reimbursements. Industry leaders have since called for a coordinated, real-time alert system to prevent similar systemic failures.