Federal investigators blamed the North Korean group TraderTraitor for the attack, as Binance moves to replace missing funds.
The FBI announced Saturday that North Korean hackers were responsible for stealing $6.3 billion from Binance, publicly confirming the country’s role in the largest digital asset theft in history.
Federal authorities attributed the operation to a North Korean hacking group known as TraderTraitor, Fox News reported. The FBI, along with the U.S. Secret Service and IRS Criminal Investigation, observed the attackers converting the stolen virtual assets primarily into Ethereum. Officials said they expect the funds to be moved in stages through decentralized finance platforms and instant cryptocurrency exchange services.
Investigators released digital wallet addresses tied to the theft and asked cryptocurrency exchanges, blockchain analytics firms and digital asset service providers to block any transactions connected to those accounts, Al Jazeera reported. The TraderTraitor collective was previously blamed for taking $1.5 billion from the cryptocurrency platform Bybit in February last year.
The federal attribution comes after Binance covered 90% of the $6.3 billion taken during the attack, using its own corporate money to purchase replacement tokens for affected customer balances.
Binance taps reserves to protect users
Binance said on Saturday that it had already restored about $6 billion of the missing assets. The company drew from multiple internal reserves to fund the purchases, including its $1 billion Secure Asset Fund for Users, which is a Bitcoin reserve established to protect customers during security breaches. The exchange also pulled funds from its Futures Insurance Fund and its corporate treasury.
Major tokens on the platform, including Bitcoin, Ethereum, Tether and BNB, are now fully backed. The remaining 10 percent of the loss consists of less liquid tokens that the exchange is purchasing through open market and over-the-counter transactions. Binance stated that those assets may take longer to acquire, but promised to continue buying until all tokens reach full coverage.
The exchange also pledged to protect its customer base from any direct losses. “Binance will absorb the financial impact of these stolen funds, not our users,” the company said in a statement. To reassure account holders, Binance released a new proof-of-reserves snapshot showing that all customer holdings are backed by at least a one-to-one ratio.
How the exchange was breached
Binance initially disclosed the massive theft on Thursday and suspended customer deposits and withdrawals after detecting the intrusion. Founder Changpeng Zhao said the incident appeared to be a hack, while cryptocurrency prices fell across the market on Friday as news of the breach spread.
Binance co-CEO Richard Teng described the intrusion as a complex attack carried out through a compromised laptop. The attackers deployed malicious software programmed to erase evidence of its activity, which made tracking the intrusion and carrying out forensic analysis difficult for investigators.
What happens next
Binance said Saturday that it remains on track to reopen user withdrawals on Sunday. The exchange continues to buy the remaining illiquid tokens to restore complete backing across all listed assets.
President Donald Trump addressed the incident on Saturday, saying federal officials are still reviewing details about Pyongyang’s suspected role. “I’m not concerned. We’re learning about it. We don’t know if it’s North Korea, but if it is, we’ll talk to them about it,” Trump told reporters.
Eric Schiffer, chairman of Patriarch and Reputation Management Consultants, called the breach one of the world’s greatest thefts. He cautioned that financial institutions face growing dangers from sophisticated cyberattacks, especially as artificial intelligence tools become more advanced.
