United States investigators have blamed North Korea for the theft of more than $6 billion worth of digital assets from Binance, now described as the largest cryptocurrency robbery ever recorded. The announcement, made public on Saturday, puts a state-backed hacking unit at the centre of an attack that drained funds from the world’s biggest crypto exchange in minutes. For ordinary investors, the immediate reassurance is that Binance says its customers will not carry the loss, but the breach has revived hard questions about how safe even the largest platforms are against government-backed attackers. Washington’s decision to name a state actor so directly also signals that it intends to treat the incident as a national security matter, not merely a company’s security failure.
What the FBI Said
According to the American authorities, the investigation points to a North Korean hacking unit known as TraderTraitor as the group responsible for the Binance theft, which took place on or about October 29, 2026. The FBI worked alongside the United States Secret Service and the criminal investigation division of the Internal Revenue Service, tracing the stolen assets as the attackers converted much of the haul into Ethereum. Officials warned that the group is expected to push the funds further through decentralised finance platforms and instant swap services, tools that let users swap digital assets quickly with relatively little identity checking. The agencies also urged exchanges, blockchain companies, analytics firms and other service providers to block transactions connected to wallet addresses linked to the hackers, since blockchain transactions cannot be reversed and blocking tainted funds is one of the few ways to stop the attackers turning their haul into usable money.
How the Hack Happened
The attack began on the afternoon of October 29, United States Eastern Time, when funds started flowing out of Binance’s hot wallets. Hot wallets stay connected to the internet so an exchange can process withdrawals quickly, and that connection makes them more exposed than cold storage, where assets are kept offline. Once the breach began, the stolen money moved across several different blockchains within minutes. Binance co-chief executive Richard Teng described the incident as a complex attack, explaining that it involved a compromised laptop and malicious software built to erase traces of its own activity, which made the intrusion harder to detect and reconstruct. Independent investigators had already reached a similar conclusion: firms including TRM Labs and Chainalysis had linked the attack to TraderTraitor, a group also connected to the Lazarus Group, and Chainalysis estimated that around $2.8 billion of the stolen assets has already been frozen.
What This Means for You
For people who hold cryptocurrency on Binance, the exchange’s message has been consistent: customers will not bear the financial impact. Binance says it has already replaced about ninety percent of the stolen assets from its own funds and is committed to covering the rest. Major holdings including Bitcoin, Ethereum, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash are already fully backed, while the remaining ten percent is in less liquid tokens that will take longer to buy back. To cover the gap, Binance set aside roughly $6.34 billion of company money, drawing in part on its one-billion-dollar Secure Asset Fund for Users, known as SAFU, together with its Futures Insurance Fund and its corporate treasury. Withdrawals were paused after the hack and Binance says it is on track to reopen them on Sunday, subject to final security checks, though delays are possible. Users should also beware of scams, since major hacks are routinely followed by fraudsters impersonating support teams or offering fake recovery services; relying only on Binance’s official channels is the safest course.
North Korea’s Record of Crypto Theft
The Binance case does not stand alone. American authorities have previously accused North Korean hackers of several of the biggest cryptocurrency heists on record, including the $1.5 billion theft from the Bybit exchange last year and a $620 million theft in 2022. Those incidents gave North Korea the record for both the largest and the second-largest crypto hacks ever, and the Binance theft, at more than four times the scale of the Bybit hack, has extended that lead dramatically. Analysts say the government relies on cyber theft as income for a heavily sanctioned regime cut off from normal international finance, recruiting promising students into hacking groups overseen by its intelligence agency. That explains why Washington treats these attacks as a strategic problem: stolen cryptocurrency can be laundered into funds supporting sanctioned activity. The story also resonates in Pakistan, where Binance has been building a presence and received a no-objection certificate to begin local registration last year. In the end, the hack will be remembered for what it revealed: a single, well-planned operation removed more value in minutes than most financial crimes manage in years. Whether trust is repaired will depend on whether frozen assets stay out of the attackers’ hands, whether exchanges act together to block tainted wallets, and whether the industry closes the gaps that let hot wallets, compromised devices and fast cross-chain transfers combine into a theft of this magnitude.
