FBI Attributes $6.3 Billion Binance Heist to North Korean Group

The FBI identified North Korean hackers as the architects of a $6.3 billion theft from Binance, marking the largest cryptocurrency heist in history. The bureau released a statement on Saturday confirming that the attack was executed by an entity called TraderTraitor. This group is also responsible for a $1.5 billion hack of Bybit last year. The FBI characterized the incident as malicious cyber activity and urged industry partners to freeze linked transactions.

The theft occurred on Thursday when $6.3 billion in bitcoin and other digital currency vanished from Binance, the world’s largest crypto exchange. The funds were gone within minutes. By Saturday, Binance stated that it held enough reserves in the same stolen currencies to cover 90% of the missing amount. The company promised full reimbursement to its customers.

Federal investigators found that TraderTraitor converted much of the stolen wealth into ethereum. The FBI expects the group will next use decentralized finance tools and instant swap services to further disguise the origin of the funds. The bureau asked blockchain analytics firms and exchanges to block specific addresses to prevent laundering.

President Donald Trump addressed the case on Saturday night while attending a Halloween event at his Mar-a-Lago estate in Florida. Asked by reporters, Trump suggested that investigators had not yet finalized their conclusion on the North Korean connection. “We don’t know if it’s North Korea,” he said. He added that it could yet be determined that they were responsible.

Ari Redbord, chief policy officer at TRM Labs, noted that hackers often fragment stolen assets to hide them in smaller exchanges. He described the process as a bank robbery at the speed of the Internet. Redbord said the group would likely launder the money over a period of months. He added that blockchain intelligence allows investigators to track these funds in real time.

The FBI’s announcement came after days of speculation regarding the North Korean link. Crypto experts had noted that the attack bore the hallmarks of a North Korean hack. The bureau’s statement provided the first official government attribution for the breach. The investigation remains open as agencies work to trace the remaining assets.