North Korea Accused of Stealing $6.3 Billion in Biggest Crypto Hack Ever as FBI Reveals Who Was Behind It

The FBI has accused North Korea of carrying out a $6.3 billion cryptocurrency theft targeting Binance, the world’s largest digital currency exchange, in what investigators believe is the biggest crypto heist ever recorded and one of the most significant financial cyberattacks in history.

The theft, which took place on October 29, 2026, sent shockwaves through the cryptocurrency industry after hackers managed to transfer billions of dollars in digital assets from Binance-controlled wallets in a short period, raising serious questions about the security of even the largest trading platforms.

According to the FBI, the operation was carried out by TraderTraitor, a hacking group linked to the North Korean government that has previously been accused of stealing enormous amounts of cryptocurrency to generate funds for the heavily sanctioned country.

American investigators believe the group has already begun moving the stolen digital assets through different cryptocurrency networks, converting significant amounts into Ethereum and potentially preparing further transactions designed to make the money increasingly difficult to trace.

The scale of the attack is unprecedented, with blockchain analysis company TRM Labs estimating that approximately $6.36 billion was removed from Binance wallets across ten different blockchain networks, including Bitcoin, Ethereum, Solana and Tron.

Much of the stolen cryptocurrency reportedly disappeared within approximately twenty minutes, suggesting that the attackers had carefully prepared the operation before launching a coordinated series of transactions that overwhelmed the exchange’s normal security protections.

Cybersecurity specialists believe the hackers may have compromised important systems responsible for authorising cryptocurrency transfers, allowing them to move digital assets that should have remained under Binance’s control.

Binance co-chief executive Richard Teng described the incident as a sophisticated attack involving multiple security breaches, including a compromised laptop and malicious software designed to erase evidence of the hackers’ activities.

The exchange responded by temporarily suspending withdrawals on several networks while its security teams investigated the breach, a decision that left customers wondering whether their investments would remain accessible and whether their cryptocurrency holdings were safe.

However, Binance has repeatedly assured users that they will not suffer financial losses as a result of the attack, promising to replace the stolen assets using the company’s own financial resources rather than passing the cost on to customers.

In an update released on Saturday, October 31, the exchange announced that it had already replenished approximately 90 percent of the stolen cryptocurrency, while the remaining ten percent would take longer to replace because some of the affected digital assets were less readily available for purchase.

The company has allocated approximately $6.34 billion to cover the damage, drawing on corporate funds and financial reserves designed to protect customers against unexpected security incidents.

Despite those assurances, the attack triggered considerable nervousness across cryptocurrency markets, with Bitcoin, Ethereum and Binance’s own BNB token experiencing sharp price declines as investors reacted to news of the historic breach.

The incident has also revived concerns about North Korea’s growing involvement in international cybercrime, particularly because the country has repeatedly been linked to sophisticated cryptocurrency thefts involving hundreds of millions or even billions of dollars.

In February 2025, hackers associated with TraderTraitor were accused of stealing approximately $1.5 billion from cryptocurrency exchange Bybit, an attack that was considered the largest theft in cryptocurrency history until the latest Binance incident.

The new attack is more than four times larger, demonstrating how rapidly the financial scale of cybercrime can increase when attackers successfully gain access to the infrastructure controlling major digital asset reserves.

Investigators are now attempting to prevent the stolen cryptocurrency from disappearing into the wider financial system, working alongside blockchain monitoring companies and cryptocurrency businesses to identify suspicious transactions and freeze assets wherever possible.

Several major cryptocurrency companies have already helped block access to substantial amounts of the stolen funds, although investigators acknowledge that some digital currencies are harder to freeze because they are not controlled by a central organisation.

The FBI has warned cryptocurrency businesses to monitor addresses associated with TraderTraitor and prevent transactions involving assets believed to have originated from the Binance theft.

Although blockchain transactions are publicly recorded, criminals can make investigations extremely complicated by repeatedly exchanging cryptocurrencies, transferring assets between different networks and distributing funds across numerous digital wallets.

North Korea has long faced international sanctions over its nuclear weapons and missile programmes, and Western authorities have repeatedly accused the country’s cyber operations of providing an important source of illicit revenue.

For Binance, the immediate challenge is restoring confidence among its enormous international customer base while demonstrating that its systems can withstand future attacks of a similar nature.

The company has promised a comprehensive security review and additional transparency concerning its financial reserves, while working towards restoring normal withdrawal services.

As investigators continue following the movement of billions of dollars in stolen cryptocurrency, the case has become a powerful reminder that even the biggest companies in the digital financial industry remain potential targets for highly organised, state-linked hacking operations.