FBI blames North Korea for $6.3 billion Binance crypto heist

On 29 October 2026, Binance — the world's largest cryptocurrency exchange by trading volume — suffered the theft of roughly $6.3 billion in digital assets, an amount the FBI described as the largest cryptocurrency heist on record. In an alert published on 31 October 2026, the bureau attributed the attack to North Korea's TraderTraitor group, the state-linked crews also tracked as the Lazarus Group, Jade Sleet and APT38.

How the attack unfolded

Binance's preliminary assessment traced the breach to a compromised laptop belonging to one of its DevOps engineers. According to the company, the attackers used that foothold to reach an internal service container and submit a series of unauthorised withdrawal transactions, moving the bulk of the funds in about twenty minutes. Binance has not said how the engineer's laptop was initially compromised. The intrusion fits the long-running pattern of North Korean operations against cryptocurrency firms, in which operators target the developers and infrastructure staff who hold privileged access rather than attacking the blockchain protocols themselves.

Scale and attribution

Estimates of the loss vary with the volatility of the tokens involved: Binance cited about $6.3 billion, while blockchain-analytics firms Elliptic and TRM Labs put the figure closer to $6.36 billion across ten different blockchains. The FBI said TraderTraitor converted most of the stolen assets into Ethereum and warned that further laundering through decentralised-finance platforms and instant-swap services was likely. Alongside the Secret Service and IRS Criminal Investigation, the bureau asked exchanges and other virtual-asset providers to block transactions tied to 628 attacker-controlled addresses. TRM Labs and Chainalysis had independently linked the theft to TraderTraitor before the FBI's public attribution; North Korea denied any involvement.

Response

Binance said it would bear the full financial impact of the theft and that customer deposits were unaffected. In successive updates the exchange reported that it had already covered around 95% of the stolen amount, with the remainder consisting of less-liquid tokens it was still repurchasing, and it confirmed that balances across its major assets remained fully backed. Binance began reopening withdrawals in phases on 1 November 2026. The heist dwarfs the group's previous records — including the 2022 Ronin Bridge theft and the 2025 Bybit hack — and renews scrutiny of how centralised exchanges protect the privileged internal systems that sit behind their custody of customer funds.