The U.S. Federal Bureau of Investigation (FBI) has accused North Korea of orchestrating a major cyberattack targeting Binance, the world’s largest cryptocurrency exchange by daily trading volume, in which more than $6 billion in digital assets were allegedly stolen.
News of the theft triggered a sharp decline in the prices of several major cryptocurrencies on Friday, sending shockwaves through the global digital asset market.
Following the attack, Binance announced that it would fully cover the losses, saying it had used its own funds to purchase tokens and recover approximately 90 percent of the stolen amount.
The exchange temporarily suspended user withdrawals as a security precaution but said services would gradually resume. The first phase of the withdrawal process restarted on Sunday.
According to figures released by Binance, between 06:00 GMT and 15:30 GMT, the platform processed $4.65 billion in withdrawals and $1.01 billion in deposits. The resulting net outflow of $3.64 billion represented approximately 2.1 percent of the company’s total assets under management.
FBI points to North Korean hacking group
In a statement published on Saturday, the FBI formally attributed the cyberattack to North Korea, identifying the hacking group TraderTraitor as responsible.
The group is suspected of having links to Pyongyang and has previously been accused of stealing approximately $1.5 billion from cryptocurrency exchange Bybit in February 2025.
The FBI said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or around October 29, 2026.
According to U.S. authorities, the hackers have begun converting the stolen assets into Ethereum. Investigators expect the funds to be moved through decentralized finance platforms and instant exchange services in an attempt to conceal their origins.
The FBI has urged private-sector companies and other organizations in the cryptocurrency industry to block transactions involving digital wallet addresses associated with TraderTraitor and the movement of the stolen funds.
Investigations into the attack are ongoing.
The incident has renewed concerns about the security of major cryptocurrency exchanges and the growing risks posed by sophisticated cyberattacks to the global digital asset market.
