The United States Federal Bureau of Investigation has formally blamed North Korea for the theft of about $6.3 billion in digital assets from Binance, the world’s largest cryptocurrency exchange — the biggest crypto heist ever recorded. The FBI issued its attribution on Saturday, NPR reported, a day after saying only that it was “aware of the incident.”
How it happened
Most of the theft unfolded over roughly 20 minutes, beginning late on Thursday 29 October, according to blockchain analysis firms TRM Labs and Chainalysis.
“An attacker moved approximately 6.36 billion USD out of Binance wallets on 10 blockchains,” TRM reported, as cited by Al Jazeera.
The sum dwarfs the previous record — $1.5 billion taken from the exchange Bybit in February 2025.
Binance initially said the breach may have begun with a compromised laptop belonging to one of its DevOps engineers, which gave the attacker access to a service container. By Friday the company said further investigation had uncovered “additional points of breach,” without specifying where. Binance said it found no evidence that any wallet’s private key had leaked. Mark Karpeles, former head of the collapsed Tokyo exchange Mt Gox, told Reuters he believed the attackers had accessed keys for at least two Binance wallets.
The attribution
TRM Labs assessed with “high confidence” that the attack was carried out by TraderTraitor, a North Korean hacking unit linked to the Lazarus Group. A Chainalysis spokesperson separately told CNN the firm had “high confidence” North Korea was responsible.
The FBI’s statement went further than suspicion. “The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH),” the agency said. “It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.”
The same unit was blamed by the FBI for the 2025 Bybit hack. The US Treasury sanctioned the Lazarus Group in 2019, describing it as controlled by North Korea’s principal intelligence bureau. Pyongyang routinely denies involvement in hacking, and CNN said it had approached North Korea’s mission at the United Nations for comment.
Binance itself has been more careful. “Our investigation has not attributed responsibility to any individual,” co-CEO Richard Teng said.
Why a state would steal cryptocurrency
Hiru News framed the motive directly in its headline: a crypto robbery to obtain foreign currency in the face of sanctions. Analysts quoted by Al Jazeera make the same case — stolen cryptocurrency has become a significant source of hard currency for Pyongyang, helping prop up its economy and fund a nuclear programme that is itself under UN sanctions.
For scale, South Korea’s intelligence service estimated in December 2022 that North Korean hackers had stolen about 1.5 trillion won — roughly $1.1 billion — in crypto and other virtual assets over five years. This single operation is several times that five-year total.
What has been recovered
About $3 billion of the stolen assets has been frozen, including more than $2.3 billion by the stablecoin issuers Tether and Circle. Binance has not said what has become of the remaining $3.3 billion, and warned that the $6.3 billion figure “may continue to increase” as it traces more assets.
The exchange suspended deposits and withdrawals on Thursday and said it would absorb the entire loss from its reserve fund and company funds. It told Al Jazeera that user funds were “safe.”
The US Secret Service, which also investigates cybercrime, said its investigators were “working around the clock” with private-sector partners including Circle to identify, freeze and trace the assets.
The Sri Lankan context
Sri Lanka has no direct exposure disclosed in any of these filings. The case nonetheless lands while the country is actively deciding how to treat this asset class: the Securities and Exchange Commission and the Ministry of Digital Economy moved in June to build a regulatory framework for virtual assets, a pivot after years of official caution from the Central Bank.
Not reported
No source identifies the individuals behind TraderTraitor, names the service container that was breached, or explains how the remaining $3.3 billion is being moved. Binance has not published a timeline for restoring suspended services. The FBI statement does not say whether any arrests or indictments are contemplated.
Three verified newsrooms, plus NPR. The FBI’s formal attribution post-dates the Al Jazeera, CNN and Hiru filings; it is carried here from NPR, which links directly to the FBI’s own alert. NPR is not on this desk’s verified-domain list and does not count toward the credibility badge, but it is the only outlet reached in reporting this story that carried the FBI’s wording.
