WASHINGTON, Oct 31 – The Federal Bureau of Investigation (FBI) has identified North Korean hackers as the group responsible for stealing approximately $6.3 billion in cryptocurrency from Binance, marking what investigators describe as the largest cryptocurrency theft in history. The attack, which took place within minutes, has raised fresh concerns about the security of digital asset exchanges and the growing sophistication of cybercriminal operations targeting the global financial system.
In a statement released Saturday, the FBI attributed the incident to a North Korean-linked hacking operation known as TraderTraitor. The bureau said the group was responsible for the malicious cyber activity behind the attack and urged cryptocurrency platforms, blockchain analytics firms and other industry participants to take immediate steps to prevent the stolen funds from being moved through the financial system.
The investigation comes as Binance, the world’s largest cryptocurrency exchange, works to recover the missing assets and reassure customers that their funds remain protected. The company said it had already reserved enough cryptocurrency to cover approximately 90% of the stolen amount and promised that affected customers would receive full reimbursement.
The incident has also drawn attention from the White House, with President Donald Trump indicating that investigators were still examining North Korea’s possible involvement in the operation.
FBI Identifies TraderTraitor and Warns of Cryptocurrency Laundering Attempts
The FBI said its investigation connected the Binance theft to TraderTraitor, a hacking entity associated with North Korea. The group has previously been linked to major cryptocurrency thefts, including the $1.5 billion attack on digital asset exchange Bybit last year.
According to the bureau, the latest operation involved the theft of billions of dollars in Bitcoin and other digital currencies from Binance. Investigators believe the attackers are now attempting to move the stolen assets through different cryptocurrency networks and services to conceal their origins and make it harder for authorities to recover them.
The FBI specifically called on cryptocurrency exchanges, blockchain intelligence companies and other organizations operating in the digital asset industry to identify and block transactions associated with a list of cryptocurrency addresses connected to the attack.
The request is part of an effort to prevent the stolen funds from entering the broader cryptocurrency market through transactions designed to disguise their ownership. By sharing information about the identified addresses, investigators hope that exchanges and other industry participants can prevent the hackers from transferring the money into accounts that would be more difficult to trace.
The bureau also disclosed that its investigation had identified a pattern in how TraderTraitor was handling the stolen assets. The hackers were primarily converting the cryptocurrency into Ethereum, one of the world’s largest digital currencies.
Investigators expect the group to continue moving the assets through decentralized finance platforms, commonly known as DeFi, as well as services that allow users to exchange one cryptocurrency for another almost instantly.
These services can make tracking suspicious transactions more complicated because digital assets may pass through multiple networks and platforms in a relatively short period. However, blockchain transactions leave publicly accessible records, allowing investigators and cryptocurrency intelligence firms to follow the movement of funds and identify connections between different wallets.
Despite the FBI’s assessment, President Trump indicated that the investigation had not necessarily established North Korea’s responsibility beyond doubt.
Speaking to reporters Saturday night during a Halloween party at his Mar-a-Lago estate in Florida, Trump was asked about the massive cryptocurrency theft and the possibility of North Korean involvement.
“I’m not concerned. We’re learning about it,” Trump said. “We don’t know if it’s North Korea.”
He added that investigators could still determine that North Korea was responsible as more information became available.
Trump’s comments came hours after the FBI publicly attributed the attack to TraderTraitor, highlighting the difference between the bureau’s stated investigative findings and the president’s remarks about the ongoing case.
Cryptocurrency security specialists say recovering the stolen assets could be a lengthy process, particularly if the hackers begin distributing the money across multiple wallets and smaller trading platforms.
Ari Redbord, chief policy officer at blockchain intelligence firm TRM Labs, said he expects the attackers to divide the stolen cryptocurrency into smaller amounts before attempting to move it through less prominent exchanges.
Breaking a large amount of cryptocurrency into smaller transactions can make suspicious activity more difficult to identify, especially when funds move between multiple wallets and services. The strategy could allow the hackers to gradually transfer the assets while attempting to avoid automated monitoring systems and law enforcement attention.
Redbord said the laundering operation could continue for months as investigators and cryptocurrency specialists attempt to follow the money.
“It’s bank robbery, in this case, at the speed of the Internet,” Redbord said, describing the speed at which digital assets can be transferred across international networks.
He also emphasized that blockchain technology gives investigators an important advantage because cryptocurrency transactions can be monitored and traced in real time.
According to Redbord, intelligence firms can use transaction records to support investigations, disrupt suspicious transfers and potentially help authorities seize stolen assets before they disappear into more complicated financial networks.
He described the situation as an ongoing contest between hackers attempting to conceal their activities and investigators working to identify and stop them.
“It’s just this cat and mouse game,” he said.
The latest incident took place Thursday, when approximately $6.3 billion in Bitcoin and other digital currencies was stolen from Binance. The scale of the theft immediately attracted attention across the cryptocurrency industry, with several experts pointing to characteristics commonly associated with North Korean hacking operations.
Binance’s position as the world’s largest cryptocurrency exchange makes the incident particularly significant for the wider digital asset market. The platform handles substantial trading activity and serves customers across numerous international markets, meaning a security breach of this magnitude could affect confidence well beyond the company itself.
The exchange responded by assuring customers that it had sufficient reserves to address most of the financial damage. In a statement Saturday, Binance said it had set aside cryptocurrency equivalent to approximately 90% of the missing assets.
The company also committed to fully reimbursing customers, seeking to prevent the theft from translating into permanent financial losses for affected users.
However, the recovery of the stolen cryptocurrency remains a separate challenge. Having sufficient reserves to compensate customers does not automatically mean the company or investigators can retrieve the assets taken by the hackers.
The FBI’s warning to cryptocurrency exchanges and blockchain analytics firms is therefore an important part of the effort to limit the consequences of the attack. Blocking transactions linked to the identified wallets could make it more difficult for the hackers to convert their holdings into usable funds.
The investigation also places renewed scrutiny on the role of North Korean cyber operations in the cryptocurrency sector. The previous $1.5 billion Bybit theft demonstrated the potential financial impact of attacks targeting digital asset platforms, while the Binance incident has brought the scale of the threat into even sharper focus.
For now, investigators are concentrating on tracking the stolen cryptocurrency, identifying the networks used to move it and preventing further laundering attempts. Whether a significant portion of the missing funds can ultimately be recovered will depend on how quickly authorities and private-sector security firms can identify and disrupt the hackers’ transactions.
With Binance promising full customer reimbursement and the FBI calling for cooperation across the cryptocurrency industry, the case has become a major test of how effectively international investigators and digital asset companies can respond to large-scale cyber theft.
The outcome could also have lasting implications for cryptocurrency security, particularly as exchanges face growing pressure to strengthen their protection systems against increasingly sophisticated hacking groups.