FBI blames North Korea for $6 billion Binance hack, the biggest crypto theft ever, as withdrawals start to reopen

The FBI said on Saturday that North Korea stole more than $6 billion in virtual assets from Binance on or about October 29, in what is thought to be the largest cryptocurrency theft on record. Binance, the world's biggest crypto exchange by daily trading volume, began reopening customer withdrawals in phases on Sunday.

The bureau named a state-backed group it calls TraderTraitor. President Donald Trump, asked about the finding at his Florida residence late on Saturday, did not endorse it. "I'm not concerned. We're learning about it. We don't know if it's North Korea," he said.

What the FBI actually said, and what it left out

The statement was short. "The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance," it read.

The FBI said it had seen TraderTraitor actors converting stolen tokens into ether, and expects further laundering through decentralised finance platforms and instant swap services. It asked the private sector to block transactions linked to more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address.

It did not publish technical evidence alongside the notice or explain how the hackers got in. The FBI says "more than $6 billion"; the $6.3 billion figure widely quoted comes from later tallies, and some estimates run to about $6.4 billion.

How it compares with earlier crypto heists

Target	Year	Amount	Blamed on
Binance	2026	More than $6 billion	North Korea (TraderTraitor), per the FBI
Bybit	2025	$1.5 billion	North Korea (TraderTraitor), per the FBI

The Binance theft is about four times the size of Bybit, which had held the record until last week. Private analysts had pointed to TraderTraitor before the FBI spoke. The US and its allies say North Korea uses stolen cryptocurrency to help pay for its weapons programmes, a charge Pyongyang rejects.

What customers need to know

Binance suspended withdrawals after the attack, and the news sent most major tokens sharply lower on Friday. The exchange now says it has used company funds to buy tokens that replace 90 percent of what was taken, and it has set aside more than $6.34 billion to cover the losses.

Withdrawals are coming back one network at a time, starting between 0600 and 0900 GMT on Sunday, with tokens prioritised by how much users asked for them over the past week. "First batch network now opened in phase one of withdrawals," the exchange posted.

In practice:

• Your balance: Binance says customers will not bear the loss, but this is the company's own promise rather than a government guarantee.
• Waiting times: Tokens with lower demand may take longer to become withdrawable.
• Scams: Thefts of this scale tend to bring a wave of fake "refund" and "recovery" messages. Binance's announcements appear on its own official channels.

This matters in Pakistan and across South Asia, where large numbers of retail users hold crypto on Binance and often rely on peer-to-peer trades to move money in and out.

The race to freeze the money

Stablecoin issuers Tether and Circle moved quickly to freeze tokens in the first hours after the theft, but most of the stolen funds are not in assets that can be frozen by an issuer. Converting them to ether makes them harder to stop, which is why the FBI is appealing directly to platforms to refuse those addresses.

Trump's response adds a political wrinkle. He often speaks with pride of his summits with Kim Jong Un during his first term, and said his administration would talk to North Korea about the matter. Binance's next update on the second phase of withdrawals is the next concrete thing users should watch for.