Federal authorities on Saturday officially attributed the unprecedented $6.3 billion digital currency theft from Binance to hackers affiliated with the North Korean government, identifying the incident as the largest cryptocurrency heist on record.
The Federal Bureau of Investigation said in a statement that operatives belonging to a group known as TraderTraitor executed the breach on or about Thursday, Oct. 29. The bureau cautioned financial platforms and blockchain analytics firms to monitor and block digital wallet addresses tied to the stolen funds, noting that the hackers have already begun converting stolen assets into Ethereum before attempting further dispersion through decentralized finance protocols and instant swap networks.
Tracing the Digital Trail
TraderTraitor has previously been tied to high-profile digital intrusions, including the $1.5 billion theft from cryptocurrency exchange Bybit in February 2025, according to federal authorities. Cybersecurity analysts widely consider the syndicate an offshoot of the Lazarus Group, a North Korean state-sponsored hacking outfit that U.S. officials blamed for the destructive 2014 cyberattack on Sony Pictures.
Ari Redbord, head of legal and government affairs at blockchain intelligence firm TRM Labs, described the rapid heist as modern theft executed without physical borders.
“It’s bank robbery, in this case, at the speed of the Internet,” Redbord said, noting that law enforcement continues to track the digital ledger in real time. “It’s just this cat and mouse game.”
Speaking Saturday evening during an event at his Mar-a-Lago resort in Florida, President Donald Trump expressed a more cautious assessment than the law enforcement agency, CBS News and other outlets reported.
“I’m not concerned. We’re learning about it,” Trump told reporters. “We don’t know if it’s North Korea,” he added, while acknowledging investigators could ultimately confirm that conclusion.
Binance Moves to Cover Losses
Binance, the world’s largest digital asset exchange, announced Saturday that it had already replaced 90 percent of the lost tokens by tapping into its corporate financial reserves. The exchange pledged that account holders would not suffer any financial impact from the attack, setting aside approximately $6.34 billion to make users whole.
To replace the missing holdings, the company drew capital from its corporate treasury alongside its Futures Insurance Fund and its $1 billion Secure Asset Fund for Users, an emergency reserve established to shield clients from security compromises. Binance stated that major tokens, including Bitcoin, Ethereum, and its native token BNB, have been restored to full 100 percent backing. Sourcing the remaining 10 percent of tokens will require more time because those assets trade in lower volumes across public markets, the firm said.
Binance Co-Chief Executive Richard Teng said the intrusion was an intricate operation carried out through an infected laptop and sophisticated software calibrated to erase traces of its own activity. Digital currency values dipped broadly following the disclosure of the breach, with Bitcoin falling nearly 5 percent, Ethereum slipping around 6 percent, and BNB retreating nearly 10 percent.
The exchange temporarily halted all account withdrawals immediately following the discovery of the breach. Binance reported Saturday that it remains on schedule to restore normal withdrawal functions on Sunday following final internal security evaluations, while international investigators continue efforts to freeze the missing funds before they can be successfully laundered.
