FBI Blames North Korea for the $6.3 Billion Binance Heist, the Biggest Crypto Hack Ever

The biggest crypto heist in history now has a name attached. The FBI says North Korea did it.

In an alert dated October 31, the FBI said North Korea was responsible for stealing “more than $6 billion USD in virtual assets” from Binance “on or about October 29, 2026.” The bureau calls this North Korean hacking activity “TraderTraitor.” The Associated Press puts the haul at $6.3 billion, which would make it the largest crypto theft on record by a wide margin.

Cover image: a PCGeek photo illustration pairing Binance founder Changpeng Zhao (CZ) with North Korean leader Kim Jong Un, made from two separate photos. It is not a photo of the two together. CZ photo: Web Summit, CC BY 2.0. Kim photo: Alexei Nikolsky / Kremlin.ru, CC BY 4.0. Both cropped.

What the FBI actually said

The alert is short, and it’s mostly about stopping the money from moving. The key points:

• Who: North Korea, through the activity the FBI tracks as TraderTraitor. AP reports it’s the same group behind last year’s $1.5 billion Bybit hack, the previous record.
• Where the money is going: The FBI, the Secret Service and IRS Criminal Investigation say the hackers are converting the stolen assets mainly into Ether (ETH). They expect the next step to be laundering through DeFi and “instant swap” services.
• What they want: Exchanges, node operators, DeFi services and blockchain analytics firms should block transactions tied to the hackers. The alert lists hundreds of Ethereum addresses, plus Bitcoin and Solana addresses.

The alert doesn’t explain how the FBI reached its conclusion, and it doesn’t describe how the break-in happened.

What Binance says

CZ founded Binance but stepped down as CEO in 2023, and Richard Teng runs the exchange now. Teng has said the attack hit Binance’s own hot wallet, not customer accounts, and that the company is covering every loss. Decrypt reports Binance set aside more than $6.34 billion in company funds to cover the losses. Teng has said the breach appears to have started with a compromised engineer’s laptop, though Binance’s investigation is still going.

Withdrawals were paused after the attack. The Hacker News reports they resumed on November 1, and that about $2.85 billion of the stolen funds has been frozen on-chain by stablecoin issuers and networks including Tether and Circle.

North Korea denies it

Pyongyang rejected the accusation. NBC News reports that Kim Yo Jong, sister of leader Kim Jong Un, called the FBI’s announcement “a trite provocation.” North Korea has long denied involvement in crypto theft. President Trump, asked about the case, said “We don’t know if it’s North Korea,” while adding that investigators could still determine it was.

What we could and couldn’t confirm

We read the FBI alert directly. It confirms the attribution, the “more than $6 billion” figure and the October 29 date. The $6.3 billion total comes from AP, and other outlets have reported slightly different numbers, so treat the exact figure as provisional. The details on Binance’s reserves, the laptop and the frozen funds come from Binance’s statements as reported by the outlets linked above. We couldn’t check those independently. The case is also still moving.

We first covered the suspected hack on October 29: Bitcoin Slides Into the $76K Range as Binance Investigates Suspected Hack.

PCGeek’s take

Two things stand out. First, the scale. One attack took more than four times the Bybit record, and a single laptop may have been the way in. Second, the response is now on-chain. The FBI posting wallet addresses and asking the industry to block them, along with billions frozen by stablecoin issuers, shows how much harder big crypto thefts are to cash out than they used to be. Harder isn’t impossible, though. North Korea has had years of practice moving stolen funds.

For regular users, the lesson is the boring one. Big exchanges hold huge hot wallets, and their security is only as good as the people with access. Long-term holdings belong in a wallet you control, and you should turn on every security feature your exchange offers.

Do you still keep crypto on an exchange, or has this pushed you to self-custody? Tell us in the comments.

Follow @pcgeekinfo for more.