FBI Says North Korea Behind Record US$6.3 Billion Binance Hack

The FBI on Saturday named North Korea as the state behind the record theft from Binance last week, attributing the attack to a hacking operation it tracks as TraderTraitor.

The bureau said the group took more than US$6 billion (AU$8.5 billion) in virtual assets from the exchange on or about 29 October. Working with the US Secret Service and IRS Criminal Investigation, the FBI has watched the hackers convert the stolen assets mainly into Ether. 

It expects them to push those funds through DeFi platforms and instant swap services in later stages of laundering.

Related: Coinbase Adds Ripple’s RLUSD Stablecoin Across Its Platforms

Block Request to Crypto Firms

The FBI urged THORChain node operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms to block transactions tied to the hackers. Its alert lists hundreds of Ethereum addresses that hold or have held the stolen assets, along with Bitcoin and Solana addresses.

Blockchain intelligence firm TRM Labs had attributed the attack to TraderTraitor with high confidence the day before. TRM estimates the attacker moved about US$6.36 billion (AU$9.03 billion) out of Binance wallets on ten blockchains. Most of the money moved in about 20 minutes, starting at 8:05 p.m. UTC.

The FBI previously tied the same group to the US$1.5 billion (AU$2.1 billion) theft from Bybit in February 2025, TRM noted. By the firm’s count, North Korea-backed hackers have stolen about US$12.8 billion (AU$18.2 billion) in crypto since 2017. Of that, US$7.4 billion (AU$10.5 billion) was taken this year.

Australia sanctioned four North Korean cyber units in November 2025, including Lazarus Group, over the regime’s crypto thefts.

Read more: VanEck Launches Diversified ETF With Bitcoin Allocation of Up to 5%

The attacker still held more than 420,000 ETH and 18,270 BTC on 30 October, according to TRM. Those coins were worth about US$2.4 billion (AU$3.4 billion). Tether, Circle, Ripple, World Liberty Financial and Arbitrum had frozen about US$2.7 billion (AU$3.8 billion) by then, the firm said.

Withdrawals Resume in Phases

Binance restarted withdrawals in phases at 6:00 a.m. UTC on Sunday. By 12:36 p.m. UTC, all 15 networks and assets in the first phase were open again.

Those withdrawals totalled US$4.649 billion (AU$6.6 billion) by 3:30 p.m. UTC. Deposits over the same hours reached US$1.01 billion (AU$1.43 billion). Binance put the net outflow at about US$3.64 billion (AU$5.17 billion), or 2.1% of its assets under management.

The exchange said it has restored backing for about 95% of the affected assets using company resources, up from 90% on Saturday. Those remaining assets are less liquid tokens outside its top ten. Binance is still buying the tokens through market and over-the-counter channels, and it has promised a post-incident report once its investigation ends.