The Federal Bureau of Investigation says North Korea stole more than $6 billion from Binance, and the clockwork speed was chilling.
Story Snapshot
- FBI attributed the Binance theft to North Korea’s TraderTraitor operation.
- About $6.36 billion moved from Binance wallets across ten blockchains, much of it in 20 minutes.
- Investigators saw the stolen funds shift into Ethereum and toward laundering paths.
- Binance confirmed a complex attack and estimated the impact at about $6.3 billion.
FBI pins the record crypto heist on North Korea
The Federal Bureau of Investigation (FBI) publicly said North Korea carried out the theft from Binance, the world’s largest crypto exchange. The Bureau tied the operation to TraderTraitor, a well-documented North Korean hacking team. The FBI also said it observed the thieves convert large portions of the haul into Ethereum, a move common in crypto laundering playbooks. The Bureau described coordination with the United States Secret Service and the Internal Revenue Service Criminal Investigation units.
Binance confirmed a complex breach and estimated the impact at nearly $6.3 billion. The company said it worked with partners to freeze a large share of the funds and keep customer service running. That confirmation gave the public a concrete scale as the hunt for the intruders continued. News agencies reported the FBI’s role in the response alongside industry teams that deal with blockchain tracing and asset freezes across networks.
The twenty-minute drain that stunned the market
TRM Labs, a blockchain intelligence firm, reconstructed the transfers in detail. Its report said an attacker moved about $6.36 billion from Binance-controlled wallets on ten blockchains. Most of the drain happened in about twenty minutes starting at 20:05 Coordinated Universal Time. The firm described “robust on- and off-chain intelligence” and attributed the attack to North Korea’s TraderTraitor group with high confidence. TRM’s timeline matched the FBI’s attribution window and post-theft asset flows.
Reporters and analysts called it the largest crypto hack on record. The activity looked familiar to anyone who tracks North Korean-linked thefts. Move fast. Fan out funds across chains. Convert into liquid tokens. Then push value through decentralized finance and instant-swap services that resist freezes. The FBI warned of that exact pattern here and urged exchanges to watch for attempts to cash out or bridge the funds into fresh venues.
What was stolen, what was frozen, what was promised
Coverage drew a line between gross transfers and lasting loss. TRM counted $6.36 billion moved. Binance estimated about $6.3 billion in impact. Reports said partners froze a large chunk quickly, and Binance pledged to make customers whole. That mix means the headline number shows the size of the breach, not a final loss bill. Investigators still track what was locked, what moved again, and what the thieves sold for spendable value.
FBI Blames North Korea for $6.3 Billion Binance Hack https://t.co/5UbCk1JgtU
— All Patriots Network A.P.N. (@AllPatriotsNet) November 1, 2026
Federal agents and private firms know this terrain well. United Nations reviews cited dozens of suspected North Korean crypto heists in prior years that funded the regime’s needs. The Binance case fits that long pattern, only bigger and faster. Conservative common sense reads this as a wake-up call. Strong walls deter bad actors. Lax controls invite them. Exchanges must harden keys, segment risk, and set tripwires so one breach cannot sweep billions in minutes.
How the chase unfolds from here
Blockchain does not forget. Tracers will follow every hop, even if the thieves split funds into thousands of chunks. The FBI flagged likely laundering routes and gave the market a heat map to watch. Centralized platforms and token issuers can freeze tagged assets, squeezing the thieves’ exit lanes. That pressure raises costs and time, which helps recovery. It also helps identify mule accounts and shell services that enable state-backed crime.
Binance will face a long cleanup. Engineers will study access paths, wallet-signing workflows, and human factors. Partners will compare malware, timing, and addresses to prior TraderTraitor runs. Law enforcement will seek seizures and arrests where reach allows. The goal is simple: reduce the pot the thieves can spend and raise the price of trying this again. That is how you protect users and make the next would-be super-heist less likely to land.
Sources:
youtube.com, fbi.gov, afp.com, en.yna.co.kr, nextgov.com, npr.org
