FBI accuses the DPRK of stealing more than $6 billion from the Binance exchange — the largest heist in the history of cryptocurrency

The largest cryptocurrency theft in history

The FBI said on Saturday that the DPRK is responsible for the theft of more than $6 billion (€5.36 billion) in virtual assets from the cryptocurrency exchange Binance, which occurred 'around October 29, 2026.' The theft, carried out in a matter of minutes, is considered the largest heist in the history of cryptocurrency. The stolen assets included bitcoin, ethereum, and stablecoins such as tether and USD Coin, whose value is pegged to traditional currencies. News of the attack sent the prices of most major cryptocurrencies tumbling on Friday: bitcoin fell almost 5%, ethereum almost 6%, and BNB, Binance's native token, almost 10%.

Who is behind the attack and what is happening with the money

According to the FBI, the theft is linked to the 'malicious cyber activity' of the TraderTraitor group — the same one behind the theft of $1.5 billion from the Bybit platform in February of last year. AFP notes that the agency's statement confirmed earlier suspicions of private researchers and analysts. According to the FBI, the perpetrators are converting the stolen assets primarily into ethereum, after which they are expected to launder them through DeFi services and instant exchange services. The agency called on cryptocurrency exchanges, blockchain analytics companies, and other market participants to block transactions involving the associated addresses so that the money cannot be laundered. AFP also reports that TraderTraitor is believed to be part of the Lazarus Group, which rose to prominence in 2014 after the hack of Sony Pictures.

The reaction of Binance and Washington

Binance — the world's largest cryptocurrency exchange by daily trading volume — said it had allocated more than $6.34 billion of its own funds to buy back tokens to cover about 90% of the stolen assets. The remaining 10% are less liquid tokens, whose buyback may take more time. 'Our commitment remains the same: Binance will fully cover the financial consequences of the funds stolen in this incident,' the company said in a post on X. After the attack, the exchange suspended user withdrawals; according to its latest update, withdrawals are expected to resume on Sunday. On Friday, Binance described the incident as a 'sophisticated attack' with multiple 'points of entry.' Meanwhile, US President Donald Trump expressed doubt about the DPRK's involvement: 'I'm not concerned. We're looking into it. We don't know whether it's the DPRK or not,' he told reporters in Florida on Saturday. The attack came amid growing concerns that the expanding capabilities of artificial intelligence models could undermine cryptography and IT security protocols. The scale of the hack, as AFP notes, drew attention to the ability of the DPRK, which is under sweeping sanctions over its nuclear and missile programs, to seek illegal sources of income.