FBI Says North Korea Stole $6.3 Billion From Binance, and About Half Is Frozen

The Federal Bureau of Investigation (FBI) has said North Korea was responsible for stealing more than $6 billion in digital assets from Binance on or about October 29, according to a Reuters report. BleepingComputer reports that the FBI named TraderTraitor, the North Korean state unit that blockchain analysts link to earlier exchange thefts, and called the theft the largest crypto heist on record. None of the reporting reviewed for this article includes a response from North Korea.

The attack did not use a flaw in any smart contract. According to Forbes, Binance traced the breach to a compromised laptop belonging to a DevOps engineer. From that laptop, the attackers reached a service container and submitted withdrawal transactions that Binance's own systems then signed. Security analysts quoted in the coverage say the attackers held a full-access token to a hot wallet (an exchange wallet whose keys sit on internet-connected machines), and that the token never expired. The root cause was compromised credentials combined with excessive privilege granted to a single internal service. Reports put the theft at about $6.3 billion moved across nine or ten blockchains, depending on the tracker, with most of it gone in roughly 20 minutes.

Recovery has split along one line: whether the asset has an issuer that can freeze it. The Hacker News reports that Tether and Circle froze more than $1.5 billion in USDT and about $800 million in USDC, bringing total frozen funds to roughly $3 billion. The United States Secret Service said it is continuing to investigate and that a large portion of the stolen funds is already frozen. Changpeng Zhao, Binance's founder, thanked the Secret Service and federal investigators in a November 2 post on X.

The bitcoin is a different matter. CoinDesk reports that the 19 wallets holding 18,270 stolen BTC have received nothing since Thursday except payments worth less than a dollar each. Each payment carries a message, ranging from pleas for money to offers of laundering services. The coins have not moved. No issuer can freeze them, so the only places to stop them are the exchanges, bridges and swap services they must eventually pass through. The FBI has urged decentralized finance (DeFi) platforms, including THORSwap (a cross-chain swap exchange), and remote procedure call (RPC) node operators to block transactions from the attacker addresses.

The political response has been mild. President Donald Trump said, "We don't know if it's North Korea but if it is we will talk to them", a remark he made before the FBI attribution became public. The analyst Darkfost estimates that North Korean hackers have now stolen about $11.87 billion in crypto in total, an amount he puts at roughly 45 percent of the country's annual gross domestic product. That ratio is one analyst's estimate, and North Korean output figures are themselves uncertain.