FBI links Binance’s $6.3bn theft to North Korea

The FBI has attributed the theft of more than $6 billion in virtual assets from Binance to North Korea, naming the operation TraderTraitor and urging crypto services to block linked transactions. The bureau’s October 31 alert dates the theft to on or about October 29 and says the stolen assets are being converted primarily into Ether.

The attribution puts a state-linked actor behind what the Associated Press describes as the largest crypto theft on record. Binance reported losses of $6.3 billion, according to the AP’s report. The scale is more than four times the $1.5 billion taken from rival exchange Bybit last year, and the FBI says TraderTraitor was also behind that attack.

What does the FBI say happened to the stolen assets?

The FBI says investigators have observed the attackers converting the assets primarily into Ether, with further laundering through decentralised finance services and instant swap services expected. It has published addresses connected to the theft and asked exchanges, DeFi services, blockchain analytics firms and other virtual asset providers to block transactions with or derived from them.

That request reflects a trade-off in crypto’s public transaction records: investigators and companies can trace funds between addresses, but tracing does not itself recover them. The AP quoted TRM Labs policy chief Ari Redbord saying investigators can track funds in real time to build cases and disrupt transfers. He also said the attackers may split the assets and move them through smaller exchanges, a process that could take months. Those are possible next steps, not a confirmed account of where all the money has gone.

How does the loss compare with Bybit, and who bears it?

The Binance theft is substantially larger than the Bybit hack, which the AP puts at $1.5 billion and links to the same group. That makes the FBI’s attribution significant beyond this incident: it connects two exceptionally large exchange losses to one North Korean operation. The FBI alert identifies the alleged perpetrators and laundering route, but does not describe how the attackers gained access to Binance.

For customers, Binance has said it will cover the loss and fully reimburse users. The exchange told the AP it had set aside enough of the same digital currency to cover 90% of the missing assets. That pledge reduces the immediate risk of customers bearing the reported loss, while leaving the recovery of the stolen funds and the exchange’s final accounting unresolved.

What should readers watch next?

The next signals are whether the listed addresses continue moving funds into Ether, whether exchanges and DeFi services block the linked transactions, and whether investigators report any funds recovered. Binance’s reimbursement progress also matters: the company’s promise addresses customer losses, but it does not establish how much of the stolen crypto can be traced, frozen or returned. The FBI’s warning points to DeFi and instant swaps as likely laundering routes, making the response of those services a key test of whether public tracing can translate into disruption.

Sources and documents

• October 31 alert — fbi.gov
• AP’s report — apnews.com