Why the FBI says North Korea is behind the Binance hack
North Korean hackers stole billions of dollars from Binance within a matter of minutes, and the U.S. government now says so on the record. In a statement Saturday, the FBI said North Korea “was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance,” according to AFP’s report on the statement.
The FBI tied the activity to what it called “malicious cyber activity” by TraderTraitor, the same group behind a $1.5 billion Bybit hack last year, according to AP. The agency said the theft happened on or about October 29, 2026. Officials said the FBI, the U.S. Secret Service and IRS Criminal Investigation all observed the activity.
Analytics firm TRM Labs had already named TraderTraitor as the perpetrator before the FBI spoke, according to The Herald Business. The statement turns that private analysis into an official government finding. For exchanges, investigators and courts, that distinction matters, because a formal attribution gives them a basis to act on wallet addresses and to coordinate with law enforcement.
How much was stolen and how Binance is covering it
The loss figures vary by source, and the gap matters for anyone trying to size their exposure. The FBI put the theft at more than $6 billion, while Binance’s updated estimate and CNBC both use $6.3 billion. Binance’s own accounting may differ from the government’s, and the company has not reconciled the two figures publicly.
| Figure | Source | What it measures |
|---|---|---|
| More than $6 billion | FBI statement, reported by AFP | Virtual assets stolen |
| $6.3 billion | Binance’s updated estimate, CNBC | Total loss estimate |
| More than $6.34 billion | Binance | Company funds set aside to cover losses |
| About $1.5 billion | Bybit hack, attributed to TraderTraitor | Earlier comparison |
Binance said it has covered 90% of the impacted amount so far, according to NBC News. In a statement, the company said: “Binance will absorb the financial impact of these stolen funds, not our users.” It also said: “This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it.”
The scale of the theft is hard to overstate. AFP describes Binance as the world’s largest crypto exchange by daily trading volume, and CNBC calls this the largest crypto theft on record. A loss of this size at the biggest exchange tests whether a company can absorb losses without passing them to customers, which is the promise Binance has made. AFP also reported that the sheer scale has drawn attention to North Korea’s ability to generate revenue despite international sanctions.
How the attackers got in, and what is still unknown
Binance’s initial investigation suggests the attacker got in through a compromised laptop belonging to a DevOps engineer, according to ABC News. A later investigation uncovered additional points of breach, but Binance did not say where they were. That leaves the initial access method only partly explained.
Korea Daily reports that the FBI did not disclose evidence or an initial infiltration vector, according to Korea Daily. That is a single-source report, so treat it with caution until more details emerge. Binance has promised a detailed post-mortem once its investigation is complete, and it has not published one yet.
Engineering laptops often hold deployment credentials and access to production systems, which makes them high-value targets. Stolen credentials and keys have become a recurring theme, as a recent Cisco SD-WAN flaw used to steal encryption keys shows. Security teams at U.S. firms should review DevOps laptop controls and credential hygiene now. Remote access software is another frequent target, as the recent TeamViewer flaw demonstrates.
Is my Binance account safe, and what Binance.US users should know
Binance.US, the U.S.-compliant exchange, said it was not impacted by the breach. Coinbase and Robinhood were also unaffected, though shares of both fell on Friday in the aftermath, according to CNBC. If you use Binance.US, the company’s statement indicates your funds were not part of this theft, but confirm that on the official site before acting.
Users of international Binance accounts should check official notices before taking any action. Binance temporarily suspended deposits and withdrawals as a precaution, and it said it was on track to resume withdrawals on Sunday, November 1. That is a company target, not a confirmed resumption, so check again before you move money.
Many holders are now asking whether an exchange is safer than self-custody. CNBC notes that on an exchange, losses may be backed by the company, while in a self-custody wallet nobody can refund losses. That is a real tradeoff, not a simple answer. Self-custody removes counterparty risk but places all recovery on the owner, while an exchange shifts risk to the company, which helps only if it stays solvent and follows through. Avoid moving funds in a rush.
Separately, Chainalysis disclosed its own breach, which it said is unrelated to the Binance theft, according to Cryptika.
Practical steps for crypto holders right now
- Go to Binance only by typing its web address or opening its official app. Do not click links in unsolicited messages.
- Treat any “reimbursement” offer, withdrawal-resumption notice sent by direct message, or support agent asking for a password, two-factor code or seed phrase as a scam.
- Check Binance’s official channels for withdrawal status before moving funds, and do not rely on screenshots or forwarded posts.
- Turn on two-factor authentication through an authenticator app rather than SMS, and review your API keys and withdrawal address allowlists.
- If you hold assets in a self-custody wallet, do not sign transactions you did not start, and avoid swap links that arrive unexpectedly.
Why the FBI wants exchanges to block addresses
The FBI expects TraderTraitor to try converting the stolen assets through DeFi protocols and “instant swap services.” It said the assets are being converted primarily into ethereum, according to AP. To keep the money from being laundered, the bureau asked exchanges, blockchain analytics firms and others to block transactions linked to various addresses.
Korea Daily reports that the FBI and partner agencies released a list of addresses that hold or held the assets. Blocking works only if exchanges and DeFi venues act quickly, before funds move through many hops. It is unknown whether the address list will lead to seizures or freezes.
CNBC quotes experts who say security incidents at exchanges are likely to continue as AI helps attackers find weaknesses in existing infrastructure. That makes this case a warning for every platform that holds customer funds, not only for Binance.
What to watch next
Three things will show how this case develops. The first is whether Binance resumes withdrawals on Sunday, November 1, as it has targeted. The second is whether it publishes the post-mortem it promised and identifies the additional breach points it has not named. The third is whether the FBI’s address list produces freezes or seizures, and whether the loss figure is revised as Binance finishes its accounting.
