FBI blames North Korea for $6.3 billion Binance theft
Crypto exchanges must now prove reserves can protect customers.
Overview
A record crypto theft has left Binance replacing about $6.3 billion in customer assets while investigators trace the stolen money. The FBI says North Korea’s carried out the breach, moving bitcoin and other tokens from Binance wallets. The attackers changed most of the stolen assets into . Authorities expect more swaps through and to make the money harder to trace.
Binance says it has replaced about 90% of the affected assets. It used its , , and company money. This restores customers’ assets but does not mean the stolen funds are back. Withdrawals are expected to resume, and Binance says it will replace the remaining assets. The case shows how crypto theft can help North Korea avoid sanctions and raise money. It also tests whether exchanges keep enough readily available funds after a major breach.
Timeline
Binance prepares to resume withdrawals while promising to cover the remaining less-liquid assets
Binance said it remained on track to resume withdrawals after restoring most of the affected backing. The company committed to covering the remaining shortfall, which it described as less-liquid assets that might take longer to obtain. The unresolved issues include whether any stolen funds can be frozen or recovered and how the loss will affect scrutiny of , and .
Binance uses SAFU, futures insurance reserves and corporate funds to absorb the immediate loss
Binance said it funded the replenishment with a partial deployment of its , part of its and . The company said it had set aside more than $6.34 billion in corporate funds and had covered about 90 percent of the impacted amount. These reserves allowed the exchange to restore customer backing while the stolen assets remained under attacker control.
Binance replaces about 90 percent of the affected customer assets without recovering the stolen funds
Binance said it had replenished approximately 90 percent of the shortfall and planned to fully reimburse customers. The replenishment represented replacement backing for affected assets, not recovery of the tokens taken by the attackers. The exchange said the remaining 10 percent consisted mainly of that could take longer to source.
Law enforcement observes TraderTraitor converting stolen assets into Ethereum for further laundering
The FBI said the attackers were converting the stolen assets primarily into Ethereum. Authorities expected additional movement through and . Splitting and swapping tokens across services can obscure their origin and make recovery more difficult.
The FBI formally attributes the Binance theft to North Korea’s TraderTraitor unit
The FBI said TraderTraitor, a North Korean , carried out the attack. The bureau worked with the U.S. Secret Service and and asked exchanges, analytics firms and other organizations to block linked addresses. The attribution places the theft within North Korea’s wider campaign to generate revenue through cryptocurrency theft.
Blockchain investigators link the Binance theft to North Korean group TraderTraitor
TRM Labs and Chainalysis identified technical and pointing to , a North Korea-linked cybercrime group. The early assessment preceded the U.S. government’s formal attribution. Investigators associated the group with earlier high-value cryptocurrency thefts.
Attackers steal approximately $6.3 billion from Binance wallets
On October 29, 2026, an attacker moved approximately $6.36 billion in from Binance wallets across multiple , in what was reported as the largest cryptocurrency theft on record. The FBI said it was investigating the incident but did not attribute it to North Korea, while blockchain researchers linked the activity to a North Korea-associated group.[1][2][6][9]