Update, Nov. 4: Binance said Tuesday that the theft grew out of a months-long campaign that began with a fake job interview and a booby-trapped coding assignment for one of its engineers, after which the attacker used a compromised internal AI tool to reach more engineers' machines, The Primary Wire reported.
Update, Nov. 2: About $2.8 billion of the stolen crypto has been frozen, leaving net outflows of about $3.6 billion from the $6.36 billion taken, Bloomberg reported Monday. North Korea's hackers are now believed to account for 89% of reported crypto-hack losses this year, according to blockchain-analysis firm Chainalysis, as cited by Bloomberg. Nick Carlsen, a senior investigator at TRM Labs, said TraderTraitor's novel techniques suggest heavy use of artificial intelligence, Bloomberg reported.
The FBI said Saturday that North Korea was responsible for stealing more than $6 billion in virtual assets from Binance, the world's largest cryptocurrency exchange, and named the hacking group it calls TraderTraitor, AFP, the Associated Press and Reuters reported. The statement turns a private-sector suspicion into the U.S. government's position, and it puts every exchange, payment firm and trading desk that handles the stolen coins on notice about where the money came from.
Binance began reopening withdrawals in phases Sunday, starting with the bitcoin network, AFP reported. In the first nine and a half hours, customers withdrew $4.65 billion and deposited $1.01 billion, a net outflow of $3.64 billion, or about 2.1% of the assets Binance manages, according to AFP. Binance has now covered 95% of the stolen tokens, AFP reported, up from the 90% it announced Saturday.
What Happened
The FBI dated the theft to on or about Oct. 29 and said that, with the U.S. Secret Service and the IRS, it had watched TraderTraitor convert the stolen assets mainly into ether, the Ethereum network's currency, ABC News reported. The bureau expects further laundering through decentralized-finance platforms, which trade tokens without a central operator, and "instant swap services."
The FBI asked crypto exchanges, blockchain analytics firms and others to block transactions tied to a list of addresses the group is using, the AP reported. The bureau blamed the same group for the roughly $1.5 billion theft from the exchange Bybit in February 2025.
Speaking to reporters Saturday night at a Halloween party at his Florida residence, President Donald Trump said, "I'm not concerned. We're learning about it. We don't know if it's North Korea," according to AP and AFP.
Binance said Saturday it had set aside about $6.34 billion of company money, including its user-protection fund and corporate treasury, and bought tokens replacing 90% of what was taken, Reuters reported. Co-CEO Richard Teng has called it a "complex attack" involving a compromised laptop and malicious software designed to delete evidence of the activity. Binance also said partners had frozen about $3 billion of the affected assets, according to ABC News.
The Primary Wire reported Friday that blockchain-analysis firms TRM Labs and Chainalysis had already tied the attack to TraderTraitor. The FBI's statement makes that the official U.S. view.
Why It Matters
Attribution changes the compliance picture for anyone downstream. The Treasury Department this week sanctioned two Russians it says convert cryptocurrency for North Korean interests, The Primary Wire reported. Exchanges, over-the-counter trading desks and fintechs should screen deposits against the FBI's address list and treat ether arriving through swap services, or coins split across many new wallets, as warning signs.
Ari Redbord, chief policy officer at blockchain intelligence firm TRM Labs, expects exactly that: the money split into pieces and moved through smaller exchanges over months. He said in the AP report that the funds can still be traced in real time, which helps seizures.
The president's public doubt leaves open whether the White House will back the FBI's finding with action toward Pyongyang, at a time when Trump often speaks with pride of his first-term summits with Kim Jong Un, AFP noted.
What to Watch
Watch whether Treasury designates laundering addresses or intermediaries, how much of the unfrozen ether is seized, and whether Binance covers the final 5% of stolen tokens.
