Why the FBI Says North Korea Is Behind the $6.3 Billion Binance Theft
Hackers drained about $6.3 billion in digital assets from Binance, the world’s largest cryptocurrency exchange, in a raid that lasted roughly 20 minutes on Thursday evening. On Saturday, the F.B.I. said a North Korean hacking unit was responsible.
The bureau tied the attack to TraderTraitor, the state-backed group behind the $1.5 billion theft from the Dubai-based exchange Bybit in February 2025, the previous record.
Trending Now!!:
The agency published Ethereum, Bitcoin and Solana wallet addresses linked to the breach and asked the public for information. President Donald Trump, questioned about the attribution at a Halloween party at Mar-a-Lago on Saturday night, said investigators did not yet know whether North Korea was involved, though he allowed that it could be. Earlier in the week he had said only that officials were “looking at that.”
The theft began around 4:05 p.m. Eastern on the XRP Ledger and spread within minutes to Ethereum and Bitcoin. The blockchain intelligence firm TRM Labs counted about $6.36 billion leaving Binance-controlled wallets across ten blockchains.
Ethereum accounted for roughly $3.8 billion of the total. Bitcoin followed with 18,270 coins, worth about $1.5 billion, then Tron at $628 million, the XRP Ledger at $296 million and Solana at $96 million.
A single transaction topped $2.5 billion, including 167,464 ether and more than 1.6 billion of the Tether stablecoin. The chief scientist at the crypto crime consultancy Elliptic called it “almost certainly the single largest-known theft of any kind.”
How the attackers got in is still being pieced together. Binance first pointed to the compromised laptop of a DevOps engineer, which gave the intruders a path to a service container and let them submit unauthorized withdrawals. The company said it had found no sign that private keys were leaked, but later acknowledged additional points of breach.
Richard Teng, a Binance chief executive, said in a video posted to X that the attackers had abused a multi-signature feature known as EIP-7702 to reach the exchange’s hot wallet, the connected wallet used to process withdrawals, and that they had used a self-destruct mechanism to complicate the investigation.
Investigators believe the hackers prepared for at least 36 hours. The attack mirrored the Bybit theft and an April attack on the KelpDAO protocol: small withdrawals through the Tornado Cash mixing service to fund an operator wallet, weeks of staging, and signatures gathered in advance and executed in one burst.
Kok Tin Gan, chief executive of the security firm NyxLab, questioned why stronger approval controls were not guarding wallets of this size.
Binance halted trading and suspended withdrawals as the money moved. Changpeng Zhao, the company’s founder, was the first to call it a hack publicly, writing on X that user funds were safe and crediting Tether and Circle, the issuers of the two largest dollar stablecoins, with freezing roughly $971 million and $823 million within hours.
Mr. Zhao left the chief executive role in 2023 after pleading guilty to money laundering violations in the United States, and he has said he no longer runs the company. Binance has promised to absorb the loss itself.
The company said it had set aside more than $6.34 billion, drawn from its emergency SAFU fund, a futures insurance fund, its bitcoin reserve and corporate cash, and by Saturday it said it had replaced about 90 percent of the stolen assets.
Withdrawals resumed on Sunday, starting with ether, Tether, USD Coin and some tokens on the exchange’s own blockchain, and the company planned to publish proof of its reserves on Monday.
Roughly $3 billion of the stolen assets has been frozen with the help of stablecoin issuers and other partners. Another $1.5 billion cannot be frozen, and about $1.8 billion remains in the hackers’ hands. The attackers moved 17,260 ether to a new address early Friday.
Garrick Hileman, an analyst, warned that the thieves were already shifting some of the unrecovered money and could run it through mixers to hide its trail. Some analysts noted that the Lazarus Group, the broader North Korean hacking collective that TraderTraitor belongs to, usually launders funds faster than this attacker had. The U.S. Secret Service said it was working to trace, freeze and recover the money. Cashing out billions in stolen crypto can take weeks or years, and often requires middlemen.
Markets wobbled but did not buckle. Bitcoin fell about 5 percent to below $80,000, and shares of Coinbase and Robinhood dropped. Institutional investors pulled money from exchanges, and CoinDCX, an Indian platform, curbed futures trading.
Some traders argued that the muted reaction reflected the exchange’s ability to cover its losses and the absence of a chain reaction across the industry. Security researchers cautioned that scammers were likely to exploit the news with phishing emails aimed at nervous customers.
The attack lands in a long line of North Korean thefts that experts say help finance the government’s weapons programs despite sanctions from the United Nations. South Korea’s spy agency estimated in 2022 that the country’s hackers had stolen about $1.1 billion in digital assets over five years, more than half of it that year alone.
Binance itself has appeared in that history before: a 2022 investigation found that Lazarus Group operators opened dozens of anonymous accounts on the platform to launder money from earlier heists.
Mr. Zhao noted that earlier incidents such as the collapse of Mt. Gox involved more bitcoin, even if this one is larger by dollar value. Andy Ward of the security firm Absolute Security said another breach of this scale was “a matter of when, not if,” and critics of exchanges, which hold enormous sums in a few wallets, say the heist will intensify scrutiny of how they are built.
