FBI says North Korea behind $6bn crypto theft

Binance suffered a major cyberattack on or about October 29, 2026. More than $6 billion in virtual assets was stolen. Withdrawals were temporarily stopped because the exchange needed to contain and investigate what it called a complex attack with several points of breach. Pausing withdrawals can help limit further losses while systems are checked.

The incident affected Binance, the world’s largest cryptocurrency exchange by daily trading volume. The FBI said a North Korea-affiliated group called TraderTraitor carried out the theft. Binance then said it had resumed withdrawals and would fully cover the financial impact using company funds.

Binance said it had set aside more than $6.34bn and used its money to buy tokens replacing 90% of the stolen funds. The remaining 10% was less liquid and could take longer to source. The hack also pushed major cryptocurrency prices sharply lower.

A cryptocurrency exchange is a service that lets people buy, sell, and trade digital tokens. It brings orders together and provides accounts through which customers manage their holdings. Binance is described in the article as the world’s largest exchange by daily trading volume, showing its central role in the market.

If an exchange holds customers’ virtual assets, the assets are kept under the exchange’s control or in wallets it manages. Customers normally rely on the exchange to preserve access and process withdrawals. That makes the exchange a valuable target: one successful attack can affect many customers at once.

The Binance hack shows why this arrangement matters. More than $6 billion was stolen, and withdrawals were temporarily stopped while the company handled the complex attack. Binance said it would cover the financial impact and had replenished 90% of the stolen tokens with company funds.

More than $6 billion in virtual assets was stolen from Binance. The company said it had set aside more than $6.34bn to cover losses. The scale matters because the attack threatened a large exchange and immediately unsettled cryptocurrency markets.

Binance said it used company money to buy tokens matching 90% of what was stolen. In practical terms, it was replacing customers’ missing holdings from its own resources. This is different from recovering the original assets. The FBI said TraderTraitor actors were converting stolen assets into Ethereum and expected further laundering.

The final 10% consisted of less liquid tokens. Binance said these could take longer to source in the required amounts. Its promise was to fully cover the financial impact, but the article does not say that investigators recovered the stolen tokens or identified every destination. Replacement therefore refers to Binance’s financial response, not necessarily to reversing the hack.

TraderTraitor is a group that the FBI linked to North Korea and blamed for stealing more than $6 billion from Binance. The article also connects it to a $1.5bn theft from Bybit in February last year. Those repeated attacks have made the group a major focus of cryptocurrency investigations.

TraderTraitor is believed to be part of the Lazarus Group. Lazarus gained notoriety in 2014, when it was accused of hacking Sony Pictures in retaliation for The Interview, a film mocking North Korean leader Kim Jong-un. The article does not describe the groups’ internal structure or prove every alleged connection.

The FBI’s statement directly attributed the Binance theft to North Korea and referred to “TraderTraitor actors.” The link matters because North Korea faces extensive sanctions over its nuclear and missile programmes. Cryptocurrency thefts could provide illicit revenue, while laundering makes the funds harder for authorities and businesses to block.

Cryptocurrency transactions are recorded digitally, but stolen funds can be moved between assets and services. The FBI said TraderTraitor actors were converting the Binance funds into Ethereum. It expected them to launder the assets further through decentralised finance and instant-swap services.

The key mechanism is conversion. A thief can exchange one token for another, use a decentralised financial service, or swap assets instantly without relying on one conventional intermediary. Each step can create new addresses, assets, and transaction paths. That can make it harder to connect the final holdings to the original theft and identify where to freeze them.

The article does not give a step-by-step laundering route or say that all the assets had already moved through these services. It says the FBI expected further conversion and urged private-sector entities to block transactions connected with TraderTraitor addresses. The warning shows that exchanges and service providers were being asked to help interrupt the chain.

The hack caused immediate market damage. Bitcoin plunged nearly 5%, Ethereum dropped nearly 6%, and BNB, Binance’s native token, fell nearly 10%. These moves show how a security failure at a major exchange can weaken confidence beyond the stolen accounts themselves.

Binance said it had set aside more than $6.34bn in company funds and used that money to replace 90% of the stolen tokens. The remaining 10% was less liquid and might take longer to source. Binance also temporarily stopped withdrawals before saying they had resumed.

The incident raised a wider enforcement problem. The FBI said the stolen assets were being converted and could be laundered through decentralised finance and instant swaps. It urged private companies to block related addresses and transactions. The alleged North Korean connection matters because the country faces extensive sanctions and is described as seeking illicit revenue through such thefts.

Cryptography is the use of mathematical methods to protect information, prove identity, and control access. IT security protocols are agreed rules and procedures that help systems authenticate users, communicate safely, and defend data. Together, they support the security of exchanges and other digital services.

More capable artificial-intelligence systems could threaten these protections in several ways. For example, they might find weaknesses faster, automate attacks, or help guess secrets at greater scale. They could also make existing security checks less reliable. These are general security concerns; the article does not identify a specific AI technique used in the Binance hack.

The Binance attack occurred as observers were already worried about AI’s expanding capabilities. The article presents that concern as a broader risk to cryptography and IT security protocols, not as the confirmed cause of this theft. Future security efforts will therefore need to account for both direct cyberattacks and the possibility that AI increases attackers’ speed and reach.