ISLAMABAD – The Federal Bureau of Investigation (FBI) has blamed North Korea for a $6.3 billion cyberattack targeting cryptocurrency exchange Binance, describing the incident as the largest cryptocurrency theft in history.
In a cyber alert issued on Saturday, the bureau identified TraderTraitor, a North Korean state-backed hacking group, as responsible for stealing more than $6 billion in virtual assets from the exchange on October 29, 2026.
The incident places North Korea behind the two largest cryptocurrency thefts on record. The same hacking group was previously linked to the $1.5 billion theft from cryptocurrency exchange Bybit.
Binance has assured users that they will not suffer financial losses. The company says it has already replaced approximately 90% of the stolen assets using its own funds.
FBI links Binance hack to North Korean hackers
In its advisory, the FBI said North Korea was responsible for stealing more than $6 billion in cryptocurrency from Binance.
The bureau said it worked with the US Secret Service and the Internal Revenue Service’s Criminal Investigation division to monitor the movement of the stolen funds.
According to the investigation, the hackers converted much of the stolen cryptocurrency into Ethereum. The FBI expects them to move the assets further through decentralised finance (DeFi) platforms and instant cryptocurrency exchange services to conceal their origins.
The agencies have urged cryptocurrency exchanges, blockchain operators and other virtual asset service providers to block transactions associated with the hackers’ wallet addresses.
Read more: Govt calls for cybersecurity education in schools, colleges
How the Binance cyberattack happened
The stolen funds began leaving Binance’s internet-connected hot wallets on the afternoon of October 29, according to the report. The assets moved across several blockchain networks within minutes.
Binance co-CEO Richard Teng described the incident as a complex attack involving a compromised laptop and malicious software designed to erase evidence of its activity.
Blockchain analytics firms TRM Labs and Chainalysis had also linked the attack to TraderTraitor, which is associated with North Korea’s Lazarus Group.
Chainalysis further reported that funds stolen from Binance had mixed on-chain with cryptocurrency taken during the previous month’s Bitget hack. That attack was also attributed to North Korean hackers.
The analytics firm estimates an approximate $2.8 billion worth of frozen stolen assets.
Read more: London’s Batman goes viral, but does Pakistan need one too?
Binance replaces 90% of stolen cryptocurrency
Binance has said that users will not bear the financial impact of the attack.
Teng said the exchange had replenished around 90% of the stolen assets and remained committed to covering the remaining amount.
According to Binance, balances in Bitcoin, Ethereum, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash are already fully backed.
The remaining shortfall involves less liquid tokens that require more time to repurchase.
To cover the losses, Binance set aside approximately $6.34 billion in company funds. The exchange drew on its $1 billion Secure Asset Fund for Users (SAFU), its Futures Insurance Fund and its corporate treasury.
Withdrawals were temporarily suspended following the attack. Binance said it expected to restore them on Sunday, subject to final security checks.
The exchange has also advised users to follow its official communication channels for updates and remain cautious of scams targeting cryptocurrency holders after major security incidents.
North Korea’s growing record of cryptocurrency theft
The Binance attack adds to a series of major cryptocurrency thefts attributed to North Korean hacking groups.
The country was previously linked to the $1.5 billion Bybit hack in 2025 and a $620 million cryptocurrency theft in 2022.
Cybersecurity experts have said that North Korea uses cryptocurrency theft to generate funds for its heavily sanctioned government.
Reports have also described how the country recruits talented students from universities into hacking groups overseen by its intelligence agencies.
What the Binance hack means for Pakistan
The incident is also relevant to Pakistan, where Binance has been expanding its presence. The cryptocurrency exchange received a no-objection certificate (NOC) in December 2025 to begin the local registration process.
The scale of the attack highlights the cybersecurity risks facing even the world’s largest cryptocurrency exchanges.
Although Binance says it will cover the losses, the incident has raised further questions about the security of digital assets and the ability of state-backed hacking groups to target major financial platforms.
The FBI’s latest advisory has called on cryptocurrency service providers to identify and block transactions connected to the stolen funds as investigations continue.
Read more: Japan scholarship that’s offering upto ¥230,000 ends this month
Key points:
- The FBI has blamed North Korea for a $6.3 billion cryptocurrency theft targeting Binance on October 29, 2026.
- The bureau identified TraderTraitor, a North Korean state-backed hacking group, as responsible for the attack.
- Binance says it has replaced around 90% of the stolen assets using its own funds.
- Blockchain analytics firms estimate that approximately $2.8 billion of the stolen cryptocurrency has been frozen.
- Binance plans to restore withdrawals following security checks after temporarily suspending them.
- The FBI has urged cryptocurrency exchanges and blockchain operators to block transactions linked to the hackers.
