FBI Links $6 Billion Binance Hack to North Korea

FBI Identifies North Korean Actors

The FBI says North Korea was responsible for stealing more than $6 billion in digital assets from Binance around October 29, putting a government attribution behind one of the crypto industry's largest security incidents.

In an October 31 alert, the agency identified the activity as TraderTraitor, its name for a North Korean malicious cyber operation. The FBI said it is working with the U.S. Secret Service and IRS Criminal Investigation to track the stolen assets and disrupt their movement.

The attribution identifies who U.S. investigators believe carried out the theft. The alert does not explain every step of the attack or establish how much of the stolen crypto will ultimately be recovered.

---

How Investigators Say the Funds Are Moving

The FBI said investigators observed the actors converting stolen assets primarily into Ether. It expects the assets to move through decentralized finance services and instant swap providers as part of further laundering. That is an expectation about what could happen next, rather than confirmation that every listed asset has already passed through those services.

The agency published a list of blockchain addresses that it says hold or have held assets from the theft and are operated by, or closely connected to, the actors. It asked infrastructure providers, exchanges, DeFi services and blockchain analytics firms to block transactions involving those addresses or funds derived from them.

Following funds across public blockchains can give investigators a trail, but moving assets between tokens and services can make tracing more complicated. A freeze can also prevent an asset from moving without necessarily returning it to the exchange.

---

Binance Details Its Response

Binance said in an October 30 update that its initial investigation suggested the incident may have involved a compromised developer operations engineer's laptop. The company said that could have given an attacker access to a service container and allowed unauthorized withdrawals. It described that explanation as an initial finding, and the investigation remained underway.

The exchange said it had worked with blockchain partners to freeze approximately $3 billion in affected assets onchain. That figure is Binance's reported amount frozen at that point; it should not be treated as the amount recovered.

In a separate update, Binance said it had set aside more than $6.34 billion in company funds, including $5 billion held in the affected assets, and would cover stolen funds through its Secure Asset Fund for Users and corporate treasury. Those are the exchange's stated commitments and figures.

---

Withdrawals Return in Phases

After the incident, Binance temporarily suspended withdrawals while it carried out security checks. In a November 1 update, the company said it was preparing to resume withdrawals in phases and directed customers to check the withdrawal page for the availability of their chosen asset and network. A phased reopening does not mean every asset and network is available at the same time.

Binance also published a proof-of-reserves snapshot and said balances for ten named assets, including Bitcoin, Ether, USDT and USDC, were fully backed. The snapshot is a point-in-time disclosure; customers should review the exchange's current information for the assets and networks they use.

---

What Comes Next

The immediate questions are how much of the frozen or stolen crypto can be recovered, whether withdrawals return across all affected networks, and what the completed investigation reveals about the breach. The FBI's warning also puts exchanges and other service providers on notice to monitor the addresses identified in its alert.

For Binance customers, the company's coverage pledge and the availability of withdrawals are separate parts of the response. The former addresses how Binance says it will cover the losses; the latter determines when customers can move a particular asset off the platform.