FBI Links $6.3 Billion Binance Heist to North Korean Hackers
The FBI identifies the Lazarus Group as the primary actor behind the massive crypto exchange breach.
The United States Federal Bureau of Investigation (FBI) has officially confirmed that the theft of $6.3 billion in assets from the Binance exchange is linked to North Korean hackers. This incident is considered the largest heist in the history of the crypto industry. According to the agency, the attack was orchestrated by the hacking collective TraderTraitor, also known as Lazarus Group, Jade Sleet, and APT38.
How the cyberattack unfolded
According to investigators, the hackers gained access to the exchange’s systems by compromising the laptop of a DevOps engineer. Using the compromised device, the attackers infiltrated a service container and sent an unauthorized request to withdraw funds. The heist was executed with extreme speed, taking just 20 minutes to drain cryptocurrency spread across 10 different blockchains.
The FBI reports that the hackers primarily convert stolen assets into Ethereum (ETH) to launder the funds through decentralized finance (DeFi) platforms and crypto-mixing services. The agency has released a list of 628 crypto addresses associated with the theft, urging cryptocurrency exchanges and service providers to block them.
The North Korean trail in cybercrime
The TraderTraitor group has long targeted cryptocurrency companies. Their name is associated with numerous high-profile cyberattacks, including the $387.5 million loss suffered by Bitget in September 2026 and the $1.5 billion theft from Bybit in February 2025. The hackers frequently employ social engineering tactics, such as "Operation DreamJob," where they pose as recruiters to send malicious files to company employees.
What is happening at Binance now
Binance leadership has stated that the company will take full financial responsibility, ensuring that users are not affected by the loss. The exchange reports that it has already recovered approximately 95% of the stolen funds, with the remaining 5% being covered through additional market purchases. The exchange began a phased restoration of withdrawal services on November 1.
While this incident highlights serious security challenges within the cryptocurrency market, Binance maintains that its core assets—including BTC, ETH, USDT, and BNB—remain fully secure. The company continues to tighten security measures to prevent similar large-scale cyberattacks in the future.