WASHINGTON — The Federal Bureau of Investigation has blamed North Korea for the largest cryptocurrency theft in history, saying hackers working for Pyongyang stole about $6 billion from Binance, the world’s largest cryptocurrency exchange, in a breach that Binance disclosed on October 31. The announcement, made by the FBI’s Internet Crime Complaint Center, attributes the theft to a North Korean state-linked hacking group known as TraderTraitor, and it warns that the stolen funds are being laundered through a complex network of wallets, exchanges and decentralised finance protocols.
The scale of the theft dwarfs every previous cryptocurrency hack, including the $1.5 billion Bybit hack in February 2025, which was also attributed to North Korea. At about $6 billion, the Binance theft is roughly four times larger than Bybit, and it represents a significant escalation in the use of cryptocurrency theft as a tool of state finance. North Korea, which is under extensive international sanctions, has long used cybercrime to generate revenue for its weapons programmes, and cryptocurrency theft has become one of its most lucrative sources of hard currency.
Binance, for its part, has moved quickly to contain the damage. The exchange said it suspended withdrawals temporarily, then resumed them after implementing additional security measures, and it set aside $6.34 billion to cover losses, a figure that exceeds the estimated value of the stolen funds. That response is important for users, because it suggests that Binance, unlike some previous victims of large hacks, has the resources to absorb the loss without passing it on to customers. It also raises questions about the exchange’s security practices, and about how a breach of this size could occur at the world’s largest exchange.
How the Hack Happened — and What the FBI Says
The FBI’s statement, as reported by multiple outlets, says that TraderTraitor, a group linked to North Korea’s Reconnaissance General Bureau, carried out the theft through a sophisticated social engineering campaign that targeted Binance employees and contractors. The group, which has been active since at least 2020, is known for impersonating recruiters, investors and business partners to gain access to corporate networks, and it has previously targeted cryptocurrency exchanges, decentralised finance projects and blockchain developers.
What the FBI has not said, at least publicly, is how exactly the hackers gained access to Binance’s hot wallets, which are the online wallets used for day-to-day transactions, or whether they exploited a specific vulnerability in Binance’s systems. That detail matters for the wider industry, because it determines whether the breach was a failure of human security, of technical security, or of both. Binance has said it is working with law enforcement and with blockchain analytics firms to trace the stolen funds, but it has not provided a detailed technical account of the breach.
The timing of the theft, on October 31, is also significant. It came just days before the U.S. midterm elections, and it coincided with a period of heightened scrutiny of cryptocurrency regulation in Washington. The theft is likely to strengthen the hand of those who argue for stricter regulation of cryptocurrency exchanges, including requirements for proof of reserves, for independent audits, and for stronger cybersecurity standards. It may also complicate Binance’s ongoing efforts to rehabilitate its reputation after its 2023 settlement with the U.S. Department of Justice, in which it pleaded guilty to money laundering and sanctions violations and paid a $4.3 billion fine.
Binance’s Response: $6.34 Billion and Resumed Withdrawals
Binance’s response to the theft has been swift and, by the standards of previous hacks, well-resourced. The exchange said it suspended withdrawals for a brief period, then resumed them after implementing additional security measures, including enhanced monitoring of large transactions and additional verification for high-value withdrawals. It also said it set aside $6.34 billion to cover losses, a figure that is slightly higher than the estimated $6 billion in stolen funds, suggesting that the exchange is prepared to cover not only the direct loss but also associated costs.
That response is in marked contrast to the Bybit hack, where the exchange was forced to borrow funds to cover losses and where users faced significant uncertainty about whether their deposits were safe. Binance’s ability to set aside $6.34 billion reflects its size and profitability, but it also raises questions about whether smaller exchanges could survive a theft of this magnitude. For the wider industry, the Binance theft is a reminder that even the largest and best-resourced exchanges are vulnerable to state-sponsored hacking groups.
The resumption of withdrawals is also important for market confidence. In previous hacks, prolonged withdrawal suspensions have triggered panic selling and further losses, as users rush to exit an exchange they fear may be insolvent. By resuming withdrawals quickly, Binance has sought to reassure users that their funds are safe, and that the exchange remains solvent. Whether that reassurance holds will depend on whether the stolen funds are recovered, or whether they are successfully laundered and disappear into the wider cryptocurrency ecosystem.
North Korea’s Crypto Playbook: From Bybit to Binance
North Korea’s use of cryptocurrency theft as a revenue source is well-documented. The United Nations has estimated that North Korea has stolen more than $3 billion in cryptocurrency since 2017, using the funds to finance its nuclear and ballistic missile programmes. The Lazarus Group, the broader hacking organisation of which TraderTraitor is a part, has been linked to some of the largest cryptocurrency thefts in history, including the $625 million Ronin Bridge hack in 2022 and the $1.5 billion Bybit hack in 2025.
The Binance theft, at $6 billion, represents a significant escalation in that campaign, and it suggests that North Korea’s hacking capabilities have grown in sophistication and ambition. It also suggests that the group’s targets have shifted from smaller, less well-defended projects to the largest exchanges in the industry, a move that carries higher risks but also higher rewards. For U.S. policymakers, the theft is a reminder that cryptocurrency theft is not just a financial crime but a national security issue, with direct implications for sanctions enforcement and for the financing of weapons of mass destruction.
The FBI’s warning about laundering is also significant. The bureau said the stolen funds are being moved through a complex network of wallets, exchanges and decentralised finance protocols, a process designed to obscure their origin and to make recovery difficult. That laundering process is likely to involve multiple jurisdictions, including countries that do not cooperate with U.S. law enforcement, and it may take months or years to trace. In previous cases, only a fraction of stolen cryptocurrency has been recovered, and the Binance theft is likely to follow a similar pattern.
What Happens Next for Users, Markets and Regulation
What happens next will be determined by three separate tracks. The first is law enforcement: whether the FBI, working with international partners, can trace and freeze any of the stolen funds, and whether any individuals involved in the theft can be identified and charged. The second is market confidence: whether Binance’s swift response and $6.34 billion reserve are sufficient to reassure users and to prevent a wider sell-off in cryptocurrency markets. The third is regulation: whether the theft strengthens the case for stricter cybersecurity and proof-of-reserves requirements for cryptocurrency exchanges, particularly in the United States.
For users, the immediate advice is straightforward: ensure that two-factor authentication is enabled, be wary of phishing attempts that may follow the breach, and consider moving large holdings to cold storage, which is offline and therefore less vulnerable to online hacking. For the wider industry, the Binance theft is a wake-up call, a reminder that state-sponsored hacking groups are capable of breaching even the largest exchanges, and that the security of the entire ecosystem depends on the weakest link in the chain.
The theft also raises a broader question about the future of cryptocurrency regulation. If the world’s largest exchange can lose $6 billion to a state-sponsored hacking group, what does that say about the security of the industry as a whole? And if North Korea can steal $6 billion in a single breach, what does that say about the effectiveness of international sanctions? Those are questions that policymakers in Washington, and in capitals around the world, will be grappling with in the weeks and months ahead, as the full scale of the Binance theft becomes clear.
Sources: Malay Mail, The Tribune, Security Affairs