FBI blames North Korea for $6.3 billion Binance crypto heist

US federal investigators accuse North Korean state-sponsored hackers of the largest cryptocurrency theft on record, after attackers breached Binance and stole more than $6 billion in digital assets.

The FBI has attributed the massive cryptocurrency heist at Binance to North Korean hackers, reinforcing suspicions that the notorious TraderTraitor group was behind the attack.

In a security alert published Oct. 31, the agency said hackers linked to North Korea stole more than $6 billion in virtual assets from the world's largest cryptocurrency exchange on or around Oct. 29.

The breach, estimated at $6.3 billion, dwarfs previous cryptocurrency thefts, including the $1.5 billion Bybit heist in February 2025, which was also attributed to North Korean hackers.

Key points

• The FBI has attributed the $6.3 billion Binance cryptocurrency theft to North Korea's TraderTraitor hackers
• Binance says the attack may have originated from a compromised employee laptop
• The attackers reportedly moved billions of dollars in cryptocurrency across multiple blockchains within minutes
• US authorities are tracking stolen assets and urging cryptocurrency services to block transactions linked to the hackers
• Binance has pledged to cover customer losses using its emergency reserves and company funds

A compromised laptop may have opened the door

Binance disclosed the security incident on Oct. 29, acknowledging that approximately $6.3 billion worth of cryptocurrency assets had been affected.

The company's preliminary investigation pointed to a compromised laptop belonging to a DevOps engineer.

The breach may have allowed attackers to access a service container and submit unauthorized withdrawal transactions, effectively exploiting access to Binance's infrastructure to move funds out of the exchange.

Binance said it had found no evidence that cryptocurrency wallet private keys were leaked.

Blockchain investigators estimate the attackers stole $6.36 billion across 10 blockchains, transferring most of the funds within just 20 minutes.

FBI identifies North Korea's TraderTraitor hackers

The FBI identified the perpetrators as TraderTraitor, a North Korean hacking operation associated with the Lazarus cybercrime ecosystem.

The group has been linked to several major cryptocurrency thefts and is known for targeting companies and employees with access to valuable digital assets.

According to the FBI, investigators working alongside the US Secret Service and IRS Criminal Investigation observed the attackers converting stolen assets, primarily into Ethereum.

Authorities expect the hackers to move the funds through decentralized finance (DeFi) platforms and instant cryptocurrency swap services to obscure their origins.

The bureau has published 628 cryptocurrency addresses associated with the theft, including 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address.

Federal investigators are urging exchanges, blockchain infrastructure operators, cryptocurrency analytics companies, and other service providers to block transactions involving the identified addresses. The goal is to disrupt the laundering operation before the stolen assets can be moved through additional services and become harder to trace.

Billions frozen as Binance promises to cover losses

Binance moved to contain the damage shortly after discovering the breach, suspending deposits and withdrawals, revoking affected authorizations, and working with law enforcement and blockchain investigators.

Cryptocurrency issuers and blockchain operators also intervened to freeze stolen assets.

Initial reports indicated that nearly $3 billion in affected funds had been frozen, including more than $1.5 billion in USDT by Tether and approximately $800 million in USDC by Circle.

Binance said it would cover losses through its Secure Asset Fund for Users (SAFU) and company reserves.

The exchange has resumed customer withdrawals following additional security checks, while efforts to trace and recover the stolen cryptocurrency continue.

North Korean hackers have a history of targeting crypto companies

The Binance attack follows years of cryptocurrency thefts attributed to North Korean hacking groups.

Among the most prominent incidents is the February 2025 breach of Bybit, in which attackers stole approximately $1.5 billion in cryptocurrency.

North Korean hackers have also been linked to attacks against DMM Bitcoin and other cryptocurrency platforms.

One of their established tactics involves approaching developers and cryptocurrency employees through fraudulent recruitment campaigns.

In these attacks, criminals pose as legitimate recruiters, offer attractive employment opportunities, and persuade targets to download malicious software or execute code disguised as a technical assessment.

The technique, commonly associated with Operation DreamJob, allows attackers to compromise employees whose systems may provide access to valuable corporate infrastructure.

While Binance's preliminary findings point to a compromised employee laptop, investigators have not publicly said that a fake recruitment campaign was responsible for this particular breach.

What crypto holders should do

Although Binance has pledged to cover customer losses, users should remain vigilant, particularly as criminals may exploit the incident to launch phishing and recovery scams.

If you use Binance or another cryptocurrency exchange:

• Watch out for fake recovery offers. Scammers may impersonate Binance representatives and promise to recover stolen funds in exchange for upfront payments or wallet access
• Use strong authentication. Enable passkeys or app-based two-factor authentication wherever supported
• Never disclose your recovery phrase. Legitimate exchanges and support representatives will not ask for your wallet's seed phrase or private keys
• Verify account notifications. Access Binance directly through its official website or app rather than following links in unsolicited emails or messages
• Review your account activity. Check for unauthorized transactions, unfamiliar devices, and changes to your security settings
• Protect your devices. Keep your operating system updated and use a trusted security solution. Avoid installing unfamiliar applications or browser extensions

For additional protection, Bitdefender security solutions can help detect malicious downloads, phishing websites, and other threats that criminals use to compromise cryptocurrency users.

The FBI is encouraging anyone with information about the theft or related laundering activity to contact their local FBI field office or submit a report through the Internet Crime Complaint Center.

On topic:

Binance hack: $6.3B theft may trace to engineer's laptop

$36.9 million crypto scam: Chinese national extradited to US over alleged money-laundering role

Crypto source of funds request: why exchanges ask and when it’s fake