The FBI has accused North Korea of stealing more than $6 billion in virtual assets from cryptocurrency exchange Binance in what is believed to be the largest crypto heist on record.
The US law enforcement agency issued its statement on Saturday as Binance reassured users that it would cover the losses. The exchange said it had used company funds to purchase replacement tokens and replenish most of the stolen assets.
Binance is the world’s largest cryptocurrency exchange by daily trading volume. News of the attack triggered sharp declines in the prices of major cryptocurrencies on Friday.
The FBI’s announcement confirmed earlier suspicions from private investigators and analysts that a North Korea-linked hacking group known as TraderTraitor was responsible for the breach.
The group was also blamed for stealing $1.5 billion from the Bybit platform in February 2025.
In its statement, the FBI said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or around October 29, 2026.
The agency added that it had observed TraderTraitor actors converting the stolen assets into Ethereum. It expects the group to launder the funds further through decentralised finance platforms and instant cryptocurrency swap services.
The FBI urged private-sector companies to block transactions involving addresses linked to the group or funds derived from the stolen assets.
However, US President Donald Trump cast doubt on North Korea’s involvement in the attack.
“I’m not concerned. We’re learning about it. We don’t know if it’s North Korea,” Trump told reporters at his residence in Florida late Saturday.
The president has frequently spoken positively about the summits he held with North Korean leader Kim Jong Un during his first term.
Binance Resumes Bitcoin Withdrawals
Binance resumed Bitcoin withdrawals on Sunday, with other cryptocurrency withdrawals scheduled to return in phases.
The exchange said it had covered approximately 95% of the $6.3 billion in stolen assets by using company funds to purchase replacement tokens.
According to Binance, the remaining 5% consists of less liquid assets that may take longer to acquire in the required quantities.
The exchange announced shortly after 0600 GMT on Sunday that the planned withdrawals had begun. The first phase included 15 cryptocurrencies, among them Bitcoin, Ether, XRP and Dogecoin.
The incident adds to a growing series of cryptocurrency thefts. Researchers at TRM Labs estimate that attackers stole $2.9 billion in cryptocurrency across nearly 150 attacks last year.
Binance Pledges to Cover Financial Losses
Binance said on Saturday that it had allocated more than $6.34 billion in company funds to cover the losses caused by the attack.
“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the company said in a post on X.
The exchange said it had already used its own funds to purchase replacement tokens covering 90% of the stolen assets. It added that sourcing the remaining tokens could take longer because of their limited liquidity.
Binance had suspended user withdrawals following the attack. However, the exchange said in its latest update that withdrawals were expected to resume on Sunday.
The hack also raised concerns about the growing capabilities of artificial intelligence systems and their potential implications for cryptography and information technology security.
Following news of the breach, Bitcoin fell nearly 5%, while Ethereum declined almost 6%. Binance’s native BNB token dropped approximately 10%.
Binance described the incident on Friday as a “complex attack” involving several “points of breach” and said it was working to resolve the issue.
North Korea’s Alleged Role in Crypto Theft
The scale of the alleged theft has renewed attention on North Korea’s ability to generate revenue through illicit activities despite extensive international sanctions over its nuclear and missile programmes.
TraderTraitor is believed to be associated with the Lazarus Group, a hacking organisation that gained international notoriety in 2014.
The group was accused of hacking Sony Pictures Entertainment in retaliation for the release of The Interview, a comedy film that mocked North Korean leader Kim Jong Un.
The latest incident adds to concerns about the security of digital assets and the growing threat posed by sophisticated cybercriminal operations.
