The FBI has attributed the Binance attack to North Korean hackers after more than $6.3 billion in cryptocurrency disappeared on October 29. Binance said it had reserved over $6.34 billion to cover losses and began gradually restoring withdrawals on November 1.
Compromised laptop provided initial access
Binance’s initial investigation linked the theft to a compromised DevOps engineer’s laptop. According to the exchange, attackers used that access to reach a service container and submit unauthorised withdrawal transactions. However, further investigation uncovered additional breach points.
Following the incident, Binance suspended deposits and withdrawals while cybersecurity specialists checked its systems. The exchange subsequently promised to cover all losses through its Secure Asset Fund for Users, known as SAFU, and company funds. Its announced reserves exceeded $6.34 billion.
Meanwhile, the gradual restoration of withdrawals marked a step towards resuming normal operations. Binance did not identify the perpetrators in the statements described in the report. The FBI, however, separately attributed the theft to North Korea.
FBI links Binance attack to TraderTraitor
In its cyber alert, the FBI identified North Korean actors tracked as TraderTraitor as responsible for the operation. The agency said the attackers converted stolen Bitcoin into Ethereum. According to investigators, those conversions formed part of preparations for further money laundering.
The FBI also published dozens of Bitcoin and Ethereum addresses associated with the stolen assets. Those wallets either held funds from the theft or had previously received them. Furthermore, the agency said North Korean TraderTraitor actors operated the addresses or maintained close connections to them.
Consequently, the FBI urged cryptocurrency platforms to block transactions involving the listed wallets. Its request covered both incoming and outgoing transfers. The alert focuses on identifiable addresses connected to the theft as investigators track the movement of funds.
North Korean group has cryptocurrency focus
TraderTraitor is a North Korean state-sponsored threat actor associated with cryptocurrency theft and financial cybercrime. Its operations target blockchain-related businesses and use several methods to gain access. These include social engineering, spear-phishing, malware and the exploitation of software vulnerabilities.
However, the group’s broader tactics do not establish exactly how every stage of the Binance attack unfolded. The exchange’s preliminary findings identified the engineer’s laptop and subsequent access to a service container. Investigators later found additional intrusion points, although the report did not detail them.
The attribution also follows an earlier FBI finding concerning the Bybit cryptocurrency exchange theft in 2025. In that incident, attackers stole approximately $1.5 billion in digital assets, and the agency blamed North Korean hackers. The reported Binance losses substantially exceed that amount.
0 responses to “Binance attack: FBI blames North Korea for $6.3B theft”