FBI accuses North Korean group of draining $6 billion from Binance

The Federal Bureau of Investigation announced on Saturday that North Korean hackers executed the largest cryptocurrency theft in history. The agency identified the Democratic People's Republic of Korea as the entity responsible for stealing more than $6 billion in virtual assets from the exchange Binance. The attack occurred on or about October 29, 2026, and the funds were drained within a matter of minutes.

The stolen portfolio included bitcoin, ethereum, and stablecoins such as tether and USD Coin. These stablecoins are pegged to traditional currencies. The FBI linked the breach to an actor group known as TraderTraitor. This same group is credited with a $1.5 billion hack of the Bybit exchange last year. Investigators observed the hackers converting the stolen assets primarily into ethereum. The FBI expects the group will use decentralized finance tools and instant swap services to further launder the funds and obscure their origins.

In response, the FBI asked crypto exchanges and blockchain analytics firms to block transactions associated with specific addresses. This measure aims to prevent the money from being fully laundered. Binance, the world's largest crypto exchange by daily trading volume, confirmed it is using over $6.34 billion in company funds to buy back tokens. The exchange stated it is replenishing approximately 90% of the stolen assets. The remaining 10% consists of less liquid tokens, which may take longer to replace.

The company posted on X that its commitment to fully cover the financial impact of the incident remains unchanged. News of the cyberattack caused the prices of most major cryptocurrencies to slump on Friday. The heist occurred as concerns grew that expanding artificial intelligence models could compromise existing cryptography and IT security protocols.

The FBI's attribution places the blame squarely on North Korea rather than a private entity. The scale of the theft, exceeding $6 billion, surpasses previous records for digital asset heists. The rapid conversion of the stolen funds into ethereum suggests a coordinated effort to move the assets through the blockchain network quickly. The involvement of TraderTraitor indicates a repeat offender with established methods for moving large sums of cryptocurrency.

Binance's decision to cover the loss with its own reserves stabilizes the immediate financial impact for users. The exchange is effectively absorbing the shock to its balance sheet to maintain confidence in the platform. The remaining 10% of the loss involves harder-to-trace or less liquid assets. The FBI's call for industry cooperation to block specific addresses is a standard but critical step in tracing digital money. The event underscores the vulnerability of major exchanges to targeted cyberattacks by state-aligned groups.