The FBI said North Korean hackers orchestrated the theft of billions of dollars in cryptocurrency from Binance, the world's largest crypto exchange, in what is now being called the biggest crypto heist in history. The bureau linked this week's attack to malicious cyber activity by a state-sponsored unit known as TraderTraitor, with Binance reporting the hack at $6.3 billion in bitcoin and other digital currency stolen on October 29.
According to the New York Post, the FBI asked crypto exchanges, blockchain analytics companies and other firms to block transactions linked to specific addresses tied to the attack. Blockchain-analysis firms have pegged the theft at slightly different totals — Elliptic put the figure at $6.43 billion, while TRM Labs estimated $6.36 billion — but all agree it dwarfs any previous exchange hack. Most of the funds moved out of Binance wallets in roughly 20 minutes, starting at 20:05 UTC on October 29, per TRM Labs' analysis.
How the Hackers Got In
The intrusion reportedly involved Ethereum's EIP-7702 delegation feature combined with control over a Binance hot wallet, according to Elliptic. Binance has said an attacker may have gained access through a compromised laptop belonging to a DevOps engineer, as reported by ABC News. The exchange said it would absorb the financial impact of the stolen funds rather than pass losses on to customers.
Crypto experts said the theft bore the hallmarks of a North Korean hack even before the FBI's formal attribution, and the bureau has since said TraderTraitor was converting the stolen assets primarily into Ethereum. The same actors were behind a $1.5 billion hack of crypto exchange Bybit last year, the FBI said — a theft the Binance incident dwarfs by a factor of roughly four, according to both TRM Labs and Elliptic's separate analyses.
Binance Moves to Restore Funds and Trust
Binance said Saturday, October 31, 2026, it had set aside enough of the same digital currency to cover 90% of the missing assets and promised customers would be fully reimbursed. Binance co-CEO Richard Teng said on X, “We've now replenished 90% of the stolen assets.” Binance had temporarily suspended deposits and withdrawals following the hack and said it expected withdrawals to resume Sunday, according to Bloomberg's reporting on the matter.
The hack rattled broader crypto markets. Bitcoin dropped as much as 5% to below $76,000 while other affected cryptocurrencies fell as much as 9%, per NBC News's market coverage, and the BBC separately reported that bitcoin's price fell by about four percentage points following news of the breach. NBC News noted the scale of the incident echoes the 2022 collapse of crypto exchange FTX, though that collapse stemmed from mismanagement rather than a cyberattack.
Investigators Brace for a Long Chase
Crypto expert Ari Redbord expects hackers will break the stolen assets into pieces and attempt to launder them through smaller exchanges to evade detection, a process he said could unfold over months. “It’s bank robbery, in this case, at the speed of the Internet,” Redbord said of the theft, adding that funds can still be tracked and traced in real time to build investigations, disrupt activity and seize assets. He described the unfolding pursuit as a cat-and-mouse game.
The FBI expects TraderTraitor will attempt to convert the remaining assets using decentralized finance platforms and instant-swap services before further laundering them, and Redbord separately told the ABC that the laundering would likely be spread across smaller exchanges. Chainalysis researchers said thousands of transactions occurred in a short period, suggesting the attackers used automation to obscure the trail of funds — including many addresses that repeatedly received exactly 1 TRX before forwarding additional funds onward, a pattern the firm described as indicative of a programmatic redistribution process.
President Donald Trump, speaking from his Mar-a-Lago estate in Florida, said investigators do not yet know whether North Korea was involved and that he was not concerned about the case, noting that investigators were still learning about it. Separately, North Korean leader Kim Jong Un attended the third meeting of company leaders of the Korean People's Army in Pyongyang, North Korea, though no link between that appearance and the hack has been established.
