FBI: North Korea Behind the Record $6.3 Billion Binance Hack
The Binance hack North Korea story is now official: the FBI has publicly accused North Korea of being behind the October 29 cyberattack that drained approximately $6.3 billion from Binance’s hot wallets — the largest cryptocurrency exchange theft ever recorded. The attribution confirms what private investigators and blockchain analysts had suspected within hours of the breach: the operation bears the fingerprints of TraderTraitor, a hacking group affiliated with Pyongyang.
The scale is difficult to overstate. At $6.3 billion, the Binance heist dwarfs the previous record — the $1.5 billion Bybit hack of February 2025, which the FBI also attributed to North Korea. In other words, the two biggest exchange hacks in crypto history were allegedly carried out by the same state-backed apparatus, just 20 months apart.
This is the full story: how the hack happened, how investigators traced it to Pyongyang, where the stolen money went, and what it means for the future of crypto security.
How the Binance Hack North Korea Operation Went Down
On October 29, 2026, attackers gained unauthorized access to Binance’s hot wallets — the internet-connected wallets exchanges use to handle routine deposits and withdrawals. Hot wallets are convenient but exposed by design: they must stay online to process transactions, which makes them the prime target for sophisticated attackers.
The theft hit multiple blockchains, with Ethereum and Bitcoin the most heavily affected assets. Binance detected the breach and immediately suspended all user withdrawals to contain the damage — a freeze that lasted until the phased resumption began on November 1 (see our coverage of Binance resuming withdrawals after the hack). Deposits were never affected.
According to co-CEO Richard Teng, multiple individuals were involved in the attack, suggesting a coordinated team operation rather than a lone intruder. That fits the known profile of North Korea’s cyber units, which operate like disciplined military teams with specialized roles: initial access, lateral movement, wallet compromise, and rapid laundering.
TraderTraitor: The Group Behind the Binance Hack North Korea Attribution
Private investigators pointed at TraderTraitor almost immediately, and the FBI’s public statement has now validated that assessment. TraderTraitor is the name the security industry gives to a cluster of activity linked to North Korea’s state hacking apparatus — the same machinery behind a long string of crypto thefts used to fund the regime’s weapons programs and evade international sanctions.
The group’s playbook is well documented from previous campaigns. Operatives typically pose as recruiters, investors, or business contacts, lure employees of crypto companies into running malicious code disguised as a job application test or a video-call plugin, and then quietly escalate access inside the corporate network until they reach the systems that control hot wallets. Once inside, they move fast: draining wallets across several blockchains in a single coordinated strike before defenders can react.
What made the Binance operation stand out was its scale and speed. Moving $6.3 billion out of hot wallets across multiple chains requires extensive preparation — compromised credentials, knowledge of the exchange’s wallet infrastructure, and a laundering pipeline ready to receive the funds the moment they land. That level of preparation is the hallmark of a state-backed actor with months of lead time, not an opportunistic criminal crew.
The Money Trail: $3 Billion Frozen, $6.34 Billion Covered
The aftermath of the Binance hack North Korea attribution has been a race on two fronts: freezing the stolen funds before they can be laundered, and making users whole.
Freezing the loot
Binance says roughly $3 billion of the stolen assets were frozen through cooperation with law enforcement agencies, intelligence firms, and industry partners. The US Secret Service confirmed it is working with private-sector partners to trace, freeze, and recover the stolen funds, and the investigation remains ongoing. Freezing crypto is a race against time — once stolen tokens are swapped across chains and run through mixers, they become far harder to claw back — so the $3 billion figure represents an unusually fast and coordinated industry response.
Covering the losses
On the user-protection front, Binance allocated more than $6.34 billion in company funds to cover the breach, and says it has replenished 95% of the affected assets — up from 90% on October 31 and 80% on October 30. The remaining 5% consists largely of smaller, less-liquid altcoins that take longer to source in the required quantities. The company’s position has been unambiguous: “Binance will absorb the financial impact of these stolen funds, not our users.” Major assets — BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC — are now backed at 100%, with a full proof-of-reserves update scheduled for November 2.
Binance Hack North Korea vs. the Bybit Hack: A Troubling Pattern
The comparison with the Bybit hack of February 2025 is unavoidable — and alarming. That $1.5 billion theft held the record for barely 20 months before the Binance attack quadrupled it. The FBI attributed both to North Korea, which points to an escalating campaign rather than isolated incidents.
- Scale: $6.3 billion vs. $1.5 billion — the Binance hack is more than four times larger.
- Attribution: both publicly blamed on North Korea by the FBI.
- Target profile: both hit top-tier exchanges with mature security teams — this is not a story about small platforms with weak defenses.
- Response: both exchanges moved to cover user losses from corporate funds, and both saw large portions of stolen assets frozen through industry cooperation.
The pattern suggests North Korea’s crypto-theft machine is getting better, not worse, at its job — bigger targets, bigger hauls, and the same laundering pipelines refined over years. For the crypto industry, the uncomfortable lesson is that even the best-resourced exchanges remain vulnerable to a patient, state-backed adversary.
What the Binance Hack Means for Crypto Security
Three takeaways stand out for anyone holding crypto, whether on Binance or elsewhere.
Hot wallets are the weak point
Both record hacks targeted hot wallets — the online wallets exchanges need for daily operations. The industry has long known that keeping large balances in hot wallets is risky, and the Binance case will intensify pressure on exchanges to keep the overwhelming majority of funds in cold (offline) storage and to insure or segregate what must stay online.
Attribution is getting faster
The speed with which private investigators named TraderTraitor — and the FBI confirmed it within days — shows how far blockchain forensics has come. Stolen funds leave permanent trails on public ledgers, and the combination of on-chain analysis, intelligence sharing, and industry cooperation froze nearly half the loot within days. That is genuine progress, even if the theft itself was not prevented.
Users need their own defenses
Exchange-level security is out of your hands, but personal security is not. Use hardware wallets for funds you do not trade actively, enable every available authentication factor on your exchange accounts, and treat any unsolicited “job offer,” “investment call,” or “test my app” message as a potential TraderTraitor-style lure — that social-engineering playbook targets individuals as well as exchange employees.
Binance Hack North Korea: Frequently Asked Questions
Did North Korea really hack Binance?
According to the FBI, yes. The bureau publicly accused North Korea of being behind the October 29 attack, confirming earlier assessments by private investigators who linked the operation to the Pyongyang-affiliated group known as TraderTraitor.
How much was stolen in the Binance hack?
Approximately $6.3 billion in digital assets was taken from Binance’s hot wallets, making it the largest cryptocurrency exchange hack on record — more than four times the $1.5 billion Bybit hack of February 2025.
Will Binance users lose their money?
No, according to Binance. The exchange allocated over $6.34 billion in company funds to cover the losses, has replenished 95% of the affected assets, and says major cryptocurrencies are 100% backed. Withdrawals resumed in phases starting November 1 — see our guide to which coins are open now.
How much of the stolen crypto was recovered or frozen?
About $3 billion was frozen through cooperation with law enforcement, intelligence firms, and industry partners, with the US Secret Service assisting in tracing and recovery. Note that “frozen” and “replenished” are different things: the frozen funds are stolen assets stopped mid-laundering, while the replenished funds are new assets Binance bought with company money to make users whole.
Who is TraderTraitor?
TraderTraitor is the industry name for a cluster of hacking activity attributed to North Korea. The group is known for elaborate social-engineering campaigns — fake job offers and business approaches — used to plant malware inside crypto companies and eventually drain their wallets.
The Bottom Line
The Binance hack North Korea attribution closes the “who” question but opens bigger ones: how a state-backed group walked away with $6.3 billion from the world’s largest exchange, and what stops it from happening again. The industry’s response — $3 billion frozen in days, users made whole from corporate funds — was fast and coordinated. But until hot-wallet security fundamentally changes, the record set on October 29 is a target waiting to be broken.
About the Author
