The FBI said Saturday that North Korean hackers were behind the theft of billions of dollars in digital currency from Binance within a matter of minutes this week in what would be the largest cryptocurrency theft on record.1,2,3
The theft struck Binance, the world's largest crypto exchange, on Thursday and involved $6.3 billion in bitcoin and other digital currency, according to the account carried by PBS and the New York Post. The FBI said the same actors were behind a $1.5 billion Bybit hack last year.1,2
The reports did not agree on the precise figure and date. PBS and the New York Post put the amount at $6.3 billion stolen on Thursday, while DW said the FBI described it as more than $6 billion, or 5.36 billion euros, taken on or about Oct. 29, 2026. The FBI statement quoted by DW said, "The Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026."1,2,3
The bureau said in a statement that the attack was tied to "malicious cyber activity" by an entity known as TraderTraitor, the same actors behind the $1.5 billion Bybit hack last year. It asked crypto exchanges, blockchain analytics companies and others to block transactions linked to various addresses to make sure the money is not laundered to cover up its origins.1,2,3
The FBI said its investigation found that TraderTraitor was converting stolen assets primarily into a cryptocurrency called ethereum. It said it expects TraderTraitor will now attempt to convert the assets using DeFi and "instant swap services." DW reported that the stolen assets included bitcoin, ethereum and stablecoins such as tether and USD Coin, whose values are pegged to traditional currencies.1,2,3
Binance had suspended withdrawals after the hack. DW reported that on Sunday Binance resumed withdrawals, saying the process would be completed in phases, with the first covering 15 cryptocurrencies, including bitcoin, ether, XRP and dogecoin. The company said Saturday that it had enough set aside in the same digital currency that was stolen to cover 90 percent of the missing assets and promised that customers would be fully reimbursed.1,2,3
News of the cyberattack caused the prices of most major cryptocurrencies to slump on Friday, DW reported.3
Crypto expert Ari Redbord said he expects the hackers will break the stolen assets into pieces and try to launder them through smaller exchanges to evade detection, a process that could unfold over months. "It's bank robbery, in this case, at the speed of the Internet," said Redbord, chief policy officer at blockchain intelligence firm TRM Labs.1,2
"However, we can also track and trace those funds in real time in order to build investigations, to disrupt and to seize back funds," he said. On Thursday, several crypto experts said the theft bore the hallmarks of a North Korean hack, before the FBI issued its attribution on Saturday.1,2
Asked by reporters as he appeared on Saturday night during a Halloween party at his Mar-a-Lago estate in Florida, however, President Donald Trump suggested investigators weren't yet certain that North Korea was involved. "I'm not concerned. We're learning about it," Trump said of the case. "We don't know if it's North Korea." Though he added that, it could yet be determined that it was.1,2
