FBI Attributes Record $6.3 Billion Binance Theft to North Korea

The FBI has attributed the theft of more than $6 billion from Binance to North Korea, turning the largest known cryptocurrency heist into both a balance-sheet test for the exchange and a sanctions-enforcement problem for the wider market.

Binance says attackers compromised hot wallets at about 20:05 UTC on October 29 and removed token assets worth roughly $6.3 billion. The exchange initially pointed to a compromised laptop, then said it had found additional breach points. It has not found evidence that private keys leaked, but the investigation and technical post-mortem remain incomplete. That distinction matters because a compromised internal workflow can require different controls from a stolen-key incident.

On October 30, Binance said it had set aside more than $6.34 billion from company resources, including $5 billion already held in the affected token assets. It promised that customers would not bear the loss and said partners had frozen about $3 billion on-chain. Frozen assets are not the same as recovered cash: ownership, legal process and token-specific controls still determine whether Binance can regain them.

The FBI named the North Korean operation TraderTraitor and said investigators observed stolen assets being converted mainly into ether. The agency warned decentralized-finance services, instant exchanges and infrastructure operators to block transactions linked to identified laundering addresses. That official attribution goes beyond the earlier assessments from private blockchain-analysis firms.

The operational picture continued to change through November 1. Binance said it had replaced or covered about 95% of the stolen assets and began resuming withdrawals for 15 assets, while less-liquid tokens accounted for the remaining shortfall. The exchange also recorded more than $3.5 billion in net outflows on Sunday according to DefiLlama data cited by Reuters, although Binance did not confirm that figure. Heavy withdrawals are a confidence signal, not proof of insolvency.

Three uncertainties remain. First, Binance has not published the full attack sequence. Second, the amount frozen may not equal the amount ultimately recovered. Third, company-funded replacement of tokens protects customer balances but still transfers the economic loss to Binance's own capital and insurance reserves.

The immediate promise of one-for-one backing is important, but verification matters more than the promise. Investors and users should watch the completed proof-of-reserves evidence, the technical incident report, the pace of withdrawal normalization and any law-enforcement recovery. Until those arrive, the event is contained operationally only in part, even if customer balances are being replenished.