WASHINGTON — The U.S. Federal Bureau of Investigation has formally attributed the largest cryptocurrency theft in history to North Korean state-sponsored hackers, as Binance raced to cover customer losses and prepared to restore withdrawals following a $6.3 billion breach that has shaken confidence in the digital-asset industry.
The FBI said Saturday that malicious actors linked to North Korea were responsible for the hack and had begun converting stolen assets into Ethereum to launder the proceeds, warning that further money-laundering steps were expected . Blockchain intelligence firms TRM Labs and Chainalysis had earlier identified the culprits as TraderTraitor, a unit within North Korea's Lazarus Group, with TRM stating it made the judgment "with high confidence" .
How the Breach Unfolded
The attack, which unfolded late Thursday, drained funds from Binance wallets across ten separate blockchains, with most of the assets moved in approximately 20 minutes . Binance's initial investigation pointed to a compromised laptop belonging to a software engineer, which gave attackers access to a service environment and allowed them to submit unauthorized withdrawal orders .
Binance co-CEO Richard Teng described the incident as a "complex attack" involving malware designed to erase its own traces, complicating detection and investigation . The exchange found no evidence that private keys had been exposed .
The stolen assets included a mix of Bitcoin, Ether, and dollar-backed stablecoins USDT and USDC . The scale of the heist dwarfed the previous record—the $1.5 billion Bybit hack in February 2025, which was also attributed to TraderTraitor .
Binance Moves to Cover Losses
Binance has pledged that no customer will bear financial losses from the breach. By Saturday, the exchange said it had replenished 90% of the stolen assets using company funds, with the remaining 10% consisting of less-liquid tokens that may take longer to acquire .
Teng said Binance's practice of holding most of its operating revenue in cryptoassets is precisely what enabled it to absorb a loss of this magnitude immediately . The exchange is also drawing on its Secure Asset Fund for Users (SAFU), a reserve fund typically maintained at around $1 billion, and has committed to replenishing it .
Withdrawals, which were suspended after the breach, were expected to resume Sunday as previously announced .
Partial Freeze, but Race Continues
Stablecoin issuers moved quickly to block portions of the stolen funds. Tether froze more than $1.5 billion in USDT connected to the hack, while Circle froze over $800 million in USDC . Blockchain partners collectively secured roughly $3 billion in affected assets .
But the hackers are already laundering what remains. TRM Labs reported that approximately 325 million USDT was sold to market makers at a discount in exchange for roughly 122,300 ETH, and that 60 million USDT was deposited as collateral on the DeFi platform Aave to borrow additional ETH . The FBI has published addresses for more than 600 crypto wallets and urged market participants to block related transactions .
Market and Regulatory Fallout
Bitcoin fell below $77,000 for the first time in more than a month on news of the breach, casting a shadow over a two-month price recovery . The incident is likely to intensify scrutiny of crypto security at a time when the Trump administration has been pushing for mainstream blockchain adoption, including a September SEC exemption allowing public company stocks to trade on blockchains .
"This is the biggest hack in history," said Aravind Srinivasan, head of systematic over-the-counter trading at crypto firm GSR . Security experts warned that the breach exposes a structural vulnerability. "Binance having enough capital to absorb this kind of damage is encouraging, but one should not confuse financial strength with operational security," said Ryan Kirkley of crypto infrastructure firm Global Settlement Network .
The FBI's formal attribution to North Korea underscores the growing role of state-sponsored cyber theft in funding the isolated regime. Pyongyang has long been accused of using cryptocurrency heists to circumvent international sanctions and finance its nuclear program . The Binance breach alone exceeds the combined estimated annual GDP of some smaller nations—and investigators say the cat-and-mouse game over the remaining funds has only just begun.