The attribution matters beyond the balance sheet of one exchange: it places the largest known crypto theft in the same lineage as earlier state-linked campaigns.
Binance has replaced 90% of the assets stolen in a $6.3bn hack of its platform, the cryptocurrency exchange said in a post on X on Saturday. The remaining 10% of tokens are less liquid and may take longer to buy back, the company said. Co-CEO Richard Teng said separately that Binance was committed to covering the remaining 10% and that users would not bear the financial impact of the incident, according to The Guardian.
The exchange suspended user withdrawals after the breach and said in its latest update that it was on track to resume them on Sunday. Binance said it had set aside around $6.34bn of company funds to cover the losses, drawing on part of its $1bn Secure Asset Fund for Users, some of its Futures Insurance Fund and its own corporate treasury. Teng described the breach on Friday as a complex attack involving a compromised laptop and malicious software designed to delete evidence of its activity, making the theft harder to trace and investigate.
The FBI confirmed on Saturday that a North Korea-affiliated group known as TraderTraitor was behind the hack, matching earlier suspicions from private investigators and analysts. TraderTraitor is believed to be part of the Lazarus Group, which gained notoriety in 2014 when it was accused of hacking into Sony Pictures over The Interview, a film that mocked Kim Jong-un. The bureau said North Korea was responsible for the theft of more than $6bn in virtual assets from Binance on or about 29 October 2026.
The FBI added that it had observed TraderTraitor actors converting stolen assets into Ethereum and expected them to be laundered further through decentralised finance and instant swap services. It urged private sector entities to block transactions with or derived from the addresses the group is using. The attribution matters beyond the balance sheet of one exchange: it places the largest known crypto theft in the same lineage as earlier state-linked campaigns, and it gives exchanges and intermediaries a named counterparty to screen against.
Markets reacted sharply. Bitcoin fell nearly 5% after news of the hack, Ethereum dropped nearly 6% and BNB, native to Binance, tumbled nearly 10%. The scale of the loss has also drawn attention to North Korea's capacity to find illicit revenue while facing extensive international sanctions over its nuclear and missile programmes. The Guardian notes that the attack came as many observers express worries that expanding artificial intelligence capabilities could compromise cryptography and IT security protocols.
What is not yet confirmed is how the stolen tokens will be recovered, whether the remaining 10% can be bought without moving prices, and whether the resumed withdrawals will proceed smoothly on Sunday. The FBI's statement identifies the group and its laundering methods but does not say how much has been traced or frozen. Binance's pledge to absorb the loss is a commitment about its own balance sheet; the wider question of how much of the $6.3bn can be clawed back from the wallets now holding it is unresolved.
