FBI blames North Korea for $6.3 billion Binance hack

The FBI has blamed North Korea for the theft of more than $6 billion in cryptocurrency from Binance. In a statement on Saturday, 31 October, the bureau said the hack was the work of TraderTraitor, a North Korean hacking group. It is the first time a US government agency has publicly named North Korea over the attack.

Binance was hacked on Thursday, 29 October. About $6.3 billion in bitcoin and other digital currency was taken in minutes, the biggest crypto theft on record. Until now, only private blockchain firms had linked the hack to North Korea. The FBI said TraderTraitor was also behind the $1.5 billion theft from the Bybit exchange last year, and is part of the wider Lazarus Group.

The FBI also listed wallet addresses it says held or moved the stolen money: more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address. It asked crypto exchanges and blockchain firms to block linked transactions, so the money cannot be laundered. The bureau said the hackers had already been changing much of the money into ether, and would likely keep moving it through decentralised finance and instant swap services.

Binance said on Saturday it had already replaced 90 percent of the stolen currency from its own reserves, and planned to reopen withdrawals on Sunday, 1 November. It has promised customers will be fully reimbursed. Stablecoin issuers have also frozen more than $2.4 billion of the stolen funds, CoinDesk reported.

Why it matters

The FBI’s statement turns a strong suspicion into an official accusation against a government. North Korea is widely believed to use stolen cryptocurrency to fund its weapons programmes, so an official finding makes it easier for other countries and companies to act. The blocked-address list also gives exchanges a clear target: if they refuse the stolen money, the hackers will struggle to turn it into cash.

What happens next

Exchanges are expected to block the listed addresses and watch for new ones, as the hackers will likely keep splitting the money across more wallets. Binance is due to reopen withdrawals on Sunday, 1 November. The FBI’s investigation continues, and recovering the funds is likely to take weeks or months, if it happens at all.

This article is for general information and education only. It is not legal or financial advice.

Sources

• https://www.coindesk.com/policy/2026/10/31/fbi-confirms-north-korea-s-role-in-usd6-billion-binance-hack-asks-defi-community-to-block-btc-eth-sol-addresses (CoinDesk, 31 October 2026)
• https://www.thehindubusinessline.com/news/world/north-korean-hackers-behind-63-billion-binance-crypto-theft-says-fbi/article71651779.ece (The Hindu BusinessLine, 1 November 2026)