FBI Blames North Korea for Record $6.3B Binance Heist as Exchange Covers Losses

Key points

• The FBI stated that North Korean actors laundered the stolen assets by converting them primarily into Ethereum, with plans to further launder the funds in stages.
• Binance co-CEO Richard Teng described the breach as a complex attack involving a compromised laptop and malicious software designed to delete evidence, making investigation difficult.
• Binance has replaced 90 percent of the stolen amount using its $1 billion Secure Asset Fund for Users, Futures Insurance Fund, and corporate treasury, with the remaining 10 percent consisting of less liquid tokens.
• The exchange halted customer withdrawals following the breach but announced it was on track to reopen them, alongside publishing a new proof-of-reserves snapshot to verify asset backing.
• The FBI provided suspected digital addresses to virtual asset service providers, urging them to block transactions associated with the latest laundering operation.

Background

This incident follows a series of earlier reports confirming the breach as the largest cryptocurrency theft on record. Previous coverage highlighted that the attack occurred in under 20 minutes and raised concerns about AI-driven attacks and systemic risks in centralized custody. While blockchain intelligence firms and the FBI attribute the breach to the TraderTraitor group, earlier reports noted that President Trump expressed uncertainty regarding the North Korean connection.

How outlets are covering it

The FBI and blockchain intelligence firms firmly attribute the heist to the North Korean group TraderTraitor, citing evidence of laundering into Ethereum and links to previous attacks. In contrast, The New York Times focuses on the internal response, describing how Binance executives established an informal war room with 100 participants to manage the crisis. While the FBI emphasizes the criminal nature and laundering tactics, The New York Times highlights the operational chaos and the speed of the digital robbery. Binance itself frames the event as a complex attack involving evidence-deleting malware, focusing on its financial commitment to cover user losses rather than the geopolitical attribution.

Why it matters

This record-breaking heist underscores the growing risks associated with centralized cryptocurrency exchanges and the sophistication of state-sponsored cybercrime. The FBI’s public attribution to North Korea and the call for industry-wide blocking of laundering addresses signal a shift toward coordinated regulatory and security responses. Furthermore, Binance’s decision to absorb the financial impact using its reserves sets a precedent for how major exchanges may handle future breaches, potentially affecting market stability and customer trust in digital asset custody.

What to watch

Binance is expected to complete the reimbursement of the remaining 10 percent of stolen funds, which involves less liquid tokens that may take longer to acquire. The exchange is on track to reopen customer withdrawals, while the FBI continues to monitor the laundering of stolen assets. Industry-wide security upgrades are anticipated as other virtual asset service providers implement the FBI’s recommended blocking measures for suspicious digital addresses.