Binance Hit by $6.3 Billion Cryptocurrency Heist as FBI Blames North Korean Hackers

A major cyberattack targeting cryptocurrency exchange Binance has resulted in the theft of approximately $6.3 billion in digital assets, triggering an international investigation after US authorities attributed the operation to North Korean state-sponsored hackers.

The Federal Bureau of Investigation (FBI) identified the hacking operation as TraderTraitor, accusing the group of stealing more than $6 billion in virtual assets from Binance on or around October 29, 2026.

The incident is among the largest cryptocurrency thefts ever reported and has raised fresh concerns about the security of digital financial platforms and the growing involvement of state-linked cybercriminal networks in international financial crime.

FBI Links $6.3 Billion Binance Hack to North Korea

In an announcement published on October 31, the FBI said North Korea was responsible for the cryptocurrency theft.

According to the agency, hackers associated with TraderTraitor began converting the stolen assets primarily into Ethereum (ETH), a move investigators believe forms part of efforts to conceal the origin of the funds.

The FBI warned that the stolen cryptocurrency could be moved through decentralised finance (DeFi) platforms and instant cryptocurrency exchange services to make tracing and recovery more difficult.

US authorities, including the FBI, US Secret Service and Internal Revenue Service Criminal Investigation division, are working to identify the movement of the stolen assets.

The agencies have also urged cryptocurrency exchanges, blockchain operators and other digital asset service providers to block transactions involving wallet addresses connected to the operation.

How Hackers Managed to Steal the Cryptocurrency

The attack exposed significant security challenges facing cryptocurrency exchanges, even those handling billions of dollars in digital assets.

Binance described the incident as a complex security breach involving a compromised laptop and malware designed to erase evidence.

The exact technical sequence of the attack remains under investigation, but the incident demonstrated how attackers can exploit weaknesses in digital infrastructure to gain access to valuable cryptocurrency holdings.

Following the breach, Binance moved to coordinate with law enforcement agencies and cryptocurrency industry partners to trace and restrict the movement of the stolen funds.

Binance Replaces Approximately $6 Billion of the Stolen Assets

In response to the attack, Binance announced that it had covered approximately $6 billion of the reported $6.3 billion loss using its own financial resources.

The company said the remaining amount, representing less than 10 per cent of the reported theft, involved less-liquid assets that could take longer to replace.

Binance indicated that it had drawn on its corporate treasury, insurance resources and security reserves to address the financial impact.

The exchange also said it was working with industry partners to locate and freeze assets connected to the attack.

However, replacing stolen customer assets does not mean the original cryptocurrency has been recovered. The funds remain the subject of an international tracing and recovery effort.

Binance Faces $4.72 Billion in Customer Withdrawals

The security incident also triggered significant activity among Binance customers, with many users withdrawing funds following news of the breach.

According to a Reuters report published on November 2, customers withdrew a net $4.72 billion from the exchange after it reopened following the attack.

Despite the substantial withdrawals, Binance said customer inflows had reached approximately $2.7 billion and that the pace of withdrawals was stabilising.

The company also maintained that the withdrawals represented around 3 per cent of its platform assets, arguing that the exchange remained financially capable of meeting customer obligations.

The incident nevertheless raised questions about investor confidence and the ability of major cryptocurrency platforms to withstand large-scale cyberattacks.

What Happened to the Stolen $6.3 Billion?

Investigators and blockchain intelligence companies are continuing to track the stolen cryptocurrency through digital wallet addresses.

The FBI has published a list of wallet addresses associated with the North Korean hacking operation, allowing cryptocurrency businesses and blockchain service providers to identify and restrict suspicious transactions.

Some of the stolen assets have reportedly been frozen by cryptocurrency issuers and industry partners. However, locating funds on a blockchain does not automatically mean authorities have recovered them.

The challenge is particularly significant because cryptocurrencies can be transferred across different networks and converted into other digital assets within a short period.

Investigators are therefore working to prevent further laundering while identifying opportunities to recover the stolen funds.

A Growing Concern Over North Korean Cryptocurrency Theft

The Binance incident has renewed international concerns over North Korea's alleged use of cybercrime to obtain foreign currency and finance activities that are difficult to support through conventional financial channels.

North Korean-linked hacking groups have previously been accused of targeting cryptocurrency exchanges, financial institutions and blockchain projects.

The latest incident highlights the scale of the threat facing the global digital asset industry, particularly as cryptocurrency platforms continue to handle increasingly large financial transactions.

Investigation Continues as Binance Works to Restore Confidence

As of November 2, 2026, the FBI's investigation into the Binance cryptocurrency theft remains ongoing, with authorities continuing to monitor wallet addresses linked to TraderTraitor.

Binance has pledged to cover the affected customer losses, while investigators and industry partners work to freeze and recover the original stolen assets.

Although the exchange has moved to reassure customers about its financial position, the incident could have lasting implications for cryptocurrency security, international cybercrime investigations and confidence in digital financial services.

The central question remains whether authorities and industry partners can recover the stolen billions before the hackers successfully move the funds beyond reach.