FBI Attributes Record $6.3 Billion Binance Crypto Heist to North Korea
In what security experts are calling the largest bank robbery in human history, state-backed hackers swept through crypto exchange Binance on Thursday, making off with more than $6 billion in digital assets in just 20 minutes. The FBI on Saturday officially attributed the massive cyber heist to North Korea, identifying a specialized military hacking unit known as TraderTraitor as the group behind the attack.
The breach hit the world’s largest cryptocurrency exchange at 4:05 p.m. Eastern on Thursday. Operating with extraordinary speed and precision, the intruders breached investor accounts and transferred just over $6.3 billion worth of cryptocurrencies before defenses could respond.
A Unprecedented Cyber Heist
Ari Redbord, global head of policy at TRM Labs—a crypto research firm working with Binance to trace and recover the assets—described the scale of the theft in stark terms. “Imagine a world where someone could walk into a bank and walk out with $6.36 billion in stolen funds and then move those funds at the speed of the internet,” Redbord said. “This is bank robbery in the age of technology.”
By collaborating with industry partners and rival exchanges, Binance managed to freeze approximately $3 billion of the stolen digital currency before the hackers could fully consolidate control. By Sunday, the exchange announced it had used its internal crypto reserves and market purchases to replace nearly 100% of customer losses, opening withdrawals back up for most account holders.
State-Sponsored Threat and Regulatory Gap
According to federal law enforcement and independent researchers, the speed and technical skill displayed in the breach immediately pointed to Pyongyang. TraderTraitor, the elite military cyber unit tied to Saturday’s FBI announcement, previously set the record for cryptocurrency theft when it drained $1.5 billion from the Bybit exchange last year.
TRM’s Redbord warned that military-backed units operate under entirely different motives than commercial cybercriminals. “North Korea has built the most sophisticated cyber capabilities in the world. They have a cadre of teams of professional hackers who are part of their military,” he noted, adding that stolen funds are frequently funneled into weapons proliferation and other destabilizing operations.
The massive intrusion has renewed sharp criticism about safety and oversight across the crypto market, which critics contrast with conventional equities venues like the New York Stock Exchange. Amanda Fischer, policy director and chief operating officer at consumer advocacy group Better Markets, pointed out that traditional investors rely on audited, insured brokers monitored by regulators. In crypto, however, exchanges routinely hold assets directly without equivalent legal mandates to restore stolen capital.
Industry advocates caution that while Binance possessed sufficient capital to absorb the loss, smaller platforms facing similar attacks might be forced into insolvency. Observers point to the 2022 collapse of FTX, whose founder Sam Bankman-Fried was sentenced to 25 years in prison for fraud after misappropriating customer assets during a liquidity squeeze. Fischer noted that when market pressures mount, dipping into client funds “can cascade into catastrophe for investors.”
While researchers continue evaluating Binance’s internal architecture for technical vulnerabilities, recovery teams continue working to track the remaining billions in frozen and moving digital assets.