Nicolas's Ownblog
← All posts
IT

FBI says North Korea stole more than $6 billion from Binance

A large office building at night, with light trails from traffic on the street beside it.

FBI headquarters, the J. Edgar Hoover Building, in Washington.

Source: FBI, public domain

The FBI said on 31 October that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about 29 October. It calls the activity TraderTraitor, the same label it used for the $1.5 billion Bybit hack in 2025. Together with the Secret Service and IRS Criminal Investigation, the FBI says the attackers are converting the stolen assets mainly into ether, and it asks node operators, exchanges and other crypto services to block transactions with the addresses involved.

Estimates of the loss vary slightly: Binance says about $6.3 billion, TRM Labs $6.36 billion, Chainalysis about $6.4 billion and Elliptic $6.43 billion. According to TRM, most of the funds left within about 20 minutes. The analytics firms put the amount frozen at about $2.7 to 2.85 billion, and Elliptic estimates the attacker still controls about $3.25 billion.

"Binance will absorb the financial impact of these stolen funds, not our users," the exchange said, naming its SAFU reserve, its futures insurance fund and its corporate treasury as the sources. It said on 31 October that it had covered 90% of the amount, and a spokesperson put the figure at about 95% the next day. That money comes from Binance's own funds, so it is not stolen money being recovered. Withdrawals resumed in phases on 1 November.

Sources