The Federal Bureau of Investigation attributed a $6.3 billion theft from cryptocurrency exchange Binance to North Korean actors on October 31. The attack occurred on or about October 29, 2026, making it one of the largest cryptocurrency exchange breaches on record.
President Donald Trump addressed the incident on October 30 during an Oval Office meeting, stating that U.S. officials were investigating the hack and possible North Korean involvement. Regarding recovery prospects, Trump cited Binance's assurances, saying the exchange told officials they had the situation "pretty much under control."
Attribution and Laundering Concerns
The FBI, U.S. Secret Service, and IRS Criminal Investigation division determined that attackers converted stolen assets primarily into ether and other cryptocurrencies. Authorities expect further conversions through decentralized finance platforms and instant swap services.
The FBI identified the North Korean cyber activity as Tradertraitor, a group previously linked to attacks on other cryptocurrency platforms. Blockchain analysis firms Chainalysis and TRM Labs independently corroborated the attribution. Chainalysis found that Binance assets were mixed with proceeds from a September theft at Bitget, also attributed to North Korean actors.
Investigators traced thousands of transfers through public blockchain records, identifying repeated returns to previously used wallets. Chainalysis said the pattern suggested automated laundering software repeatedly moved funds to obscure their origins.
Exchange Recovery Plan
Binance reserved more than $6.34 billion in company funds to cover losses, drawing on company reserves, its Secure Asset Fund for Users, and futures insurance reserves. An October 31 update reported 90% replenishment across 10 cryptocurrencies, including Bitcoin, Ether, and XRP, with full backing confirmed for those assets.
The exchange pledged to absorb all losses and was sourcing additional tokens to cover remaining shortfalls. Binance targeted Sunday, November 1 for withdrawal resumption and published a reserve snapshot taken at midnight UTC on October 31. Full cryptographic proof was expected by November 3, allowing token holders to verify 1:1 backing.
Federal Response
The FBI urged cryptocurrency exchanges, blockchain infrastructure operators, and digital asset service providers to block transactions involving addresses used by the attackers. The agency released a list of addresses associated with laundering the stolen assets and called for private-sector assistance in disrupting those transfers.
