FBI Links North Korea to Record $6.3 Billion Binance Crypto Theft

OPA WIRE, Nov 1 (OPA) — The FBI confirmed Saturday that the hacking group known as TraderTraitor orchestrated the theft, marking a significant escalation in state-sponsored cybercrime. Investigators observed the attackers converting stolen funds into Ethereum to obscure the digital trail. The agency has issued an urgent advisory to virtual asset service providers, urging them to block specific digital addresses linked to the laundering operation.

Binance reported that it has already replaced 90 percent of the stolen assets using its internal reserves, including the $1 billion Secure Asset Fund for Users (SAFU). Co-CEO Richard Teng described the breach as a sophisticated operation involving a compromised laptop and specialized malware designed to purge forensic evidence. The exchange plans to cover the remaining 10 percent of less liquid tokens as they become available.

This incident follows the group's alleged involvement in a $1.5 billion theft from the Bybit platform in February 2025. The FBI’s attribution highlights the persistent threat posed by North Korean cyber units, which frequently target global financial infrastructure to bypass international sanctions. The scale of this breach represents one of the largest digital asset thefts in history.

Binance suspended withdrawals immediately following the attack but announced plans to resume operations by Sunday. To restore market confidence, the exchange released a new proof-of-reserves snapshot, allowing users to verify that their holdings remain backed at a 1:1 ratio. The company maintains that it will absorb the full financial impact of the breach to protect its user base.