The Federal Bureau of Investigation has formally attributed a record-breaking $6.3 billion cryptocurrency theft to North Korea, identifying the cyberattack against the world’s leading digital asset exchange as a state-backed operation.
In a formal statement released Saturday, October 31, federal investigators stated that the Democratic People’s Republic of Korea was responsible for stealing more than $6 billion in virtual assets from Binance around October 29, 2026. The bureau pinned the cyber heist on TraderTraitor, a North Korean hacking faction tied to the broader Lazarus group, which is itself affiliated with Pyongyang’s intelligence services.
According to federal authorities, the hackers have been actively converting the plundered funds into Ether, the native cryptocurrency of the Ethereum network, ahead of further laundering operations. The FBI noted that the perpetrators are utilizing rapid exchange mechanisms that allow digital tokens to be swapped instantly without routing through conventional banking intermediaries or traditional verification channels.
To combat the laundering effort, the law enforcement agency published a registry of approximately 500 Ethereum addresses currently deployed by TraderTraitor operatives. The bureau directed cryptocurrency platforms and decentralized finance services to block all transaction flows associated with these flagged addresses.
The scale of the attack dwarfs previous digital thefts. The $6.3 billion haul is four times larger than the $1.5 billion siphoned from the ByBit platform in February 2025, which had stood as the previous benchmark for cryptocurrency heists.
Security analysts note that the operation underscores North Korea’s ongoing reliance on illicit cyber revenue streams to circumvent crushing international sanctions imposed over its nuclear and ballistic missile initiatives. The Lazarus group has a long history of high-profile state-sponsored cyberattacks, including the 2014 breach of Sony Pictures Entertainment in retaliation for a satirical feature film about North Korea.
Historical intelligence reports, including a 2000 U.S. military assessment, estimated that Pyongyang’s specialized cyber warfare unit, Bureau 121, maintains roughly 6,000 personnel operating from international outposts, including Belarus, China, India, Malaysia, and Russia. Meanwhile, digital asset market scale remains vast; Binance holds the top position in trading volume with 335 million registered users, while broader industry estimates place the global count of cryptocurrency owners above 700 million.
In response to the breach, Binance suspended user withdrawals temporarily to stem capital outflows. Company representatives announced that withdrawals would resume Sunday, November 1, and assured account holders that no customer would suffer financial losses.
Binance management reported that the firm is actively tracing the stolen holdings in cooperation with other participants across the digital asset ecosystem. The exchange stated it has purchased replacement assets matching the siphoned funds, successfully reconstituting 90 percent of the missing balance while continuing recovery efforts for the remaining 10 percent in less liquid holdings.
The attack unfolded amid growing warnings from technical observers regarding the future vulnerabilities of computer security. Industry specialists have expressed concern that advancing artificial intelligence capabilities could eventually compromise standard cryptographic protocols and network defenses.
