FBI says North Korea was behind theft of more than $6bn from Binance

As reported by BBC News, The Guardian and Deutsche Welle. The allegations below are theirs, not Vocemundi's.

The FBI said on Saturday 31 October that North Korea was responsible for the theft of more than $6bn in virtual assets from cryptocurrency exchange Binance. The theft took place on or about 29 October 2026.

The FBI tied the theft to an entity it calls TraderTraitor. It also linked TraderTraitor to the $1.5bn theft from the Bybit exchange in 2025. The reports reviewed by Vocemundi do not describe the evidence behind the FBI's attribution.

Binance said on Saturday, including in posts on X, that it had replenished about 90% of the stolen assets. It said it had set aside about $6.34bn in company funds. According to Al Jazeera, Binance also announced a new proof-of-reserves snapshot, which it said lets users independently verify that their assets are backed at a minimum 1:1 ratio. Binance suspended withdrawals after the hack. It said it was on track to reopen them on Sunday 1 November. The reports do not say whether this happened.

Several outlets put the total stolen at $6.3bn but do not say where that figure comes from. The BBC and DW describe the hack as believed to be the largest cryptocurrency theft on record.

The stolen funds

The FBI said TraderTraitor actors were converting the stolen assets, primarily into ethereum. It said it expected them to be laundered further through decentralised finance (DeFi) and instant swap services. It asked exchanges, analytics companies and others "to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets", according to the Guardian.

According to the BBC, Binance said it had frozen around $3bn of the stolen assets on Friday. The BBC also reported that the US Secret Service was working with private sector partners "to identify, freeze, trace, and recover funds".

Covering the losses

Binance said it bought replacement tokens using its Secure Asset Fund for Users (SAFU) and its corporate treasury. It said the remaining roughly 10% consists of less liquid tokens that may take longer to acquire.

Prices of major cryptocurrencies fell after news of the hack. According to the Guardian, bitcoin fell nearly 5% and BNB, Binance's own token, nearly 10%.

What is disputed

• The BBC describes TraderTraitor as another name for the Lazarus Group. The Guardian says it is believed to be part of that group.
• The Verge attributes the 90% statement to "the company's CEO". Other outlets describe it as a company post and call Richard Teng co-CEO.

What each side says

• FBI: North Korea, through TraderTraitor actors, was responsible for the theft.
• Binance: "Binance will absorb the financial impact of these stolen funds, not our users," the company said, according to the BBC.
• Richard Teng, Binance co-CEO: On Friday, Teng described a "complex attack" involving a compromised laptop and malware designed to delete evidence. According to the BBC, he said the hackers used a "self-destruct mechanism".
• North Korea: According to the BBC, North Korea has always denied involvement in such attacks. The reports do not include its response to this accusation.

Vocemundi note: this story relays allegations published by BBC News, The Guardian and Deutsche Welle. Vocemundi did not have access to the underlying evidence or documents and has not independently verified these claims. The people and organisations named are presumed innocent; their response is included where it was available.

Analysis

The FBI's public attribution and its request to block identified addresses shift part of the response to private exchanges and analytics firms. How much of the money can be frozen may depend on how widely they comply. Binance's pledge to cover all losses, if fulfilled, could limit direct harm to users. Binance says its new proof-of-reserves snapshot, reported by Al Jazeera, allows users to independently verify that their assets are backed at least 1:1. Whether withdrawals resume smoothly could affect market confidence. The attribution may also add to wider debate over state-linked cyber theft. North Korea's past denials suggest the accusation is likely to remain contested.

Produced by the Vocemundi newsroom with AI assistance.