FBI blames North Korea for record $6.3bn crypto heist from Binance

Binance lost virtual assets worth $6.3bn in a record cryptocurrency theft. The FBI linked the operation to North Korea and identified the group behind it as TraderTraitor. The case matters because the stolen assets were not simply missing: investigators observed an organized effort to move and disguise them through crypto transactions.

The FBI said TraderTraitor converted the stolen assets primarily into Ethereum. It also said the assets were expected to be further laundered in stages. The agency published suspected digital addresses and asked virtual asset service providers to block transactions connected with the operation.

TraderTraitor had already been blamed for stealing $1.5bn from the Bybit platform in February last year. The Binance theft is therefore four times larger than that earlier heist. Binance stopped withdrawals after the breach, while the company worked to replace the stolen tokens and reassure customers their funds remained safe.

A cryptocurrency exchange is a service where customers buy, sell, trade, and store digital assets. Binance is described as the world’s largest crypto exchange. It holds customers’ assets because users rely on the platform to keep those assets available for trading and withdrawal instead of managing every transaction themselves.

That arrangement makes an exchange a valuable target. In this case, Binance said a complex attack involved a compromised laptop and malicious software designed to delete evidence. After the breach, the exchange stopped customers from withdrawing funds while it responded. It later said withdrawals were on track to reopen on Sunday.

Binance tried to reassure users in two ways. It used company resources to replace 90 percent of the stolen amount, and it published a new proof-of-reserves snapshot. That snapshot allowed users to independently verify that their assets were backed at a minimum 1:1 ratio. The article does not explain Binance’s detailed custody architecture.

The Binance theft was valued at $6.3bn in virtual assets. That makes it a record theft in the account provided. The size matters because losses on this scale can shake confidence in an exchange, disrupt customer access, and affect crypto prices beyond the directly targeted platform.

The same group, TraderTraitor, had previously been blamed for a $1.5bn theft from the Bybit platform in February last year. Comparing the figures shows the Binance haul was $4.8bn larger. Put another way, $6.3bn was four times $1.5bn.

The scale also explains Binance’s response. The company said it used money from its SAFU reserve, its Futures Insurance Fund, and its corporate treasury to buy replacement tokens. It said 90 percent had been replaced, while the remaining 10 percent involved less liquid tokens that could take longer to purchase.

Crypto laundering is the process of moving stolen digital assets in ways that make their origin harder to follow. Converting assets into Ethereum can change the form of the funds. Sending them through different digital addresses can create a longer, more complicated trail for investigators to analyze.

The FBI said North Korean malicious actors were observed laundering the Binance assets by converting them primarily into Ethereum. It also said the assets were expected to be further laundered in stages. The agency provided suspected digital addresses so virtual asset service providers could watch for and block related transactions.

This does not mean the funds automatically disappear from view. Crypto transactions can often be examined on public blockchains, but tracing movement is not the same as recovering money. Binance and investigators therefore faced two linked problems: following the assets and stopping later transfers before the stolen tokens moved further through the system.

The immediate effects were both practical and financial. Binance stopped allowing customers to withdraw their funds after the hack. Crypto prices also fell on Friday as the exchange tried to reassure customers that their funds were safe. The disruption showed how a security breach can affect access and market confidence at the same time.

Binance later said it was on track to reopen withdrawals on Sunday. It also announced a new proof-of-reserves snapshot. Users could independently check whether their assets were backed at a minimum 1:1 ratio, giving customers a way to assess the exchange’s reported holdings.

The company separately said it had replaced 90 percent of the stolen amount by buying new tokens with its own resources. The remaining 10 percent consisted of less liquid tokens. Binance said it would continue buying the relevant assets and would absorb the financial impact rather than pass it to users.

Binance said it would absorb the loss rather than make customers pay. To replace the stolen assets, it used money from its $1bn Secure Asset Fund for Users, known as SAFU. This is a Bitcoin reserve fund Binance holds to protect customers during security breaches.

The company also drew on some of its Futures Insurance Fund and its corporate treasury. It used those resources to buy new tokens, covering 90 percent of the stolen amount. The remaining 10 percent consisted of less liquid tokens, which Binance said might take longer to purchase.

Binance promised to continue buying the relevant token assets until coverage reached 100 percent for all tokens. This approach protects users from the immediate financial loss, but it uses company reserves and other funds to do so. The article does not state how much of each fund was spent.

Blockchain transactions are often trackable because transfers are recorded on a shared digital ledger. Anyone who can access the relevant blockchain may be able to see movements between addresses. That visibility helps investigators follow stolen assets and identify patterns in how they move.

Recovery is harder because an address is not automatically a person’s real-world identity. Stolen funds can also be split, transferred through many addresses, or exchanged for different tokens. In this case, the FBI said the assets were converted primarily into Ethereum and expected to be further laundered in stages.

These transactions are generally designed to be final rather than reversible. The article supports the tracking problem directly: the FBI supplied suspected addresses and asked providers to block transactions. That response shows the practical goal is often to interrupt or freeze movement, not simply erase completed transfers and return the assets automatically.