Over $6 billion in 20 minutes: FBI accuses North Korea of largest-ever crypto hack against Binance

The FBI called on cryptocurrency exchanges, blockchain infrastructure operators, and other digital asset service providers to help prevent the stolen funds from moving further through the system.Follow us on Google A representation of the cryptocurrency is seen in front of Binance logo in this illustration taken, March 4, 2022. (photo credit: REUTERS/DADO RUVIC/ILLUSTRATION)NOVEMBER 1, 2026 10:22The FBI accused North Korea of stealing more than $6 billion in cryptocurrency from Binance in a cyberattack on Thursday, identifying the perpetrators as a North Korean hacking operation known as TraderTraitor, according to a statement released on Saturday.The attack, which occurred on October 29, is believed to be the largest cryptocurrency theft in history, surpassing previous cyberattacks targeting digital asset exchanges.In its official cybersecurity alert, the FBI attributed the theft to the Democratic People's Republic of Korea (DPRK), North Korea's official name, and warned that the hackers had already begun converting the stolen funds into other cryptocurrencies.Working alongside the US Secret Service and the Internal Revenue Service's Criminal Investigation division, the bureau said investigators had observed TraderTraitor operatives converting stolen digital assets primarily into Ethereum (ETH), one of the world's largest cryptocurrencies.The agencies warned that the stolen assets were expected to undergo additional laundering through decentralized finance (DeFi) platforms and instant cryptocurrency exchange services, potentially complicating efforts to trace and recover the funds.Biance app is seen on a smartphone in this illustration taken, July 13, 2021. (credit: REUTERS/DADO RUVIC/ILLUSTRATION)The blockchain intelligence firm TRM Labs estimated that approximately $6.36 billion was transferred from Binance wallets across 10 blockchain networks during the October 29 attack, with most of the assets moved in roughly 20 minutes. The firm attributed the operation to TraderTraitor with high confidence.US agencies urge cryptocurrency platforms to block stolen fundsThe FBI called on cryptocurrency exchanges, blockchain infrastructure operators, and other digital asset service providers to help prevent the stolen funds from moving further through the financial system.The appeal specifically targeted THORNode operators, remote procedure call (RPC) node operators, instant exchanges, DeFi services, and blockchain analytics firms.These organizations were urged to block transactions involving digital wallet addresses identified as being controlled by or closely connected to the North Korean hackers.The FBI published an extensive list of cryptocurrency addresses associated with the theft, including wallets on the Ethereum, Bitcoin and Solana networks. The bureau said the addresses either currently hold or previously held assets stolen during the attack.The alert reflects concerns that the hackers could exploit the decentralized nature of cryptocurrency transactions to obscure the origins of the stolen assets and move them beyond the reach of investigators.Binance said Saturday that it had replenished approximately 90% of the stolen cryptocurrency and set aside about $6.34 billion in company funds to cover the losses. The exchange also said it had been working with blockchain partners to identify and freeze affected assets.The company suspended withdrawals after the breach and said it was working the restore service on Sunday. Binance co-CEO Richard Teng described the breach as a complex attack involving a compromised laptop and malware designed to erase evidence of the intrusion.The exchange has pledged to cover customers' losses, drawing on its corporate treasury and financial reserves as it works to restore normal operations.Follow us on Google