FBI Attributes More Than $6 Billion Binance Crypto Theft to North Korea
The FBI said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on October 29, 2026. Binance said withdrawals resumed and that it had bought tokens to replace 90% of the stolen assets, while the breach shook crypto markets.
By DoomRadar · Published on DoomRadar . Updated .
Places in the report
Countries named in the cited reporting. Highlighting does not show the area affected. Map: Natural Earth.
How the effects could reach youConditional effects
Based on two sources with available article excerpts. Source-linked claims are not independent confirmation.
Event date: The theft occurred on or about October 29, 2026, according to the FBI statement quoted by Jowhar News Leader. [2]
What happened
The FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026. The finding was presented as a law-enforcement attribution, not as an independently established court ruling. [2]
References for this detail (1)
- FBI: North Korea Linked to $6 Billion Cryptocurrency Heist - Jowhar News Leaderjowhar.com · Article published: Nov 1, 2026, 10:20 AM UTC
Binance said it had resumed withdrawals after the breach and was absorbing the damage. The exchange also said it had used company funds to buy tokens replacing 90% of the assets taken. [2]
References for this detail (1)
- FBI: North Korea Linked to $6 Billion Cryptocurrency Heist - Jowhar News Leaderjowhar.com · Article published: Nov 1, 2026, 10:20 AM UTC
The incident placed Binance, described as the world’s largest cryptocurrency exchange by daily trading volume, at the centre of a broad selloff. Major digital coins fell sharply as confidence across the sector was shaken. [2]
References for this detail (1)
- FBI: North Korea Linked to $6 Billion Cryptocurrency Heist - Jowhar News Leaderjowhar.com · Article published: Nov 1, 2026, 10:20 AM UTC
Private investigators and analysts had previously pointed to TraderTraitor, a North Korea-linked operation believed to be part of the broader Lazarus Group. The group has used fake job offers and malware to steal data and digital assets, according to the Strait Times. [2][1]
References for this detail (2)
- Five things to know about North Korea's TraderTraitor hackersstraitstimes.com · Article published: Nov 1, 2026, 3:23 AM UTC
- FBI: North Korea Linked to $6 Billion Cryptocurrency Heist - Jowhar News Leaderjowhar.com · Article published: Nov 1, 2026, 10:20 AM UTC
The reported attribution follows other attacks linked to North Korean hackers, including the 2016 theft of $81 million from Bangladesh’s central bank and the 2017 WannaCry ransomware attack, which disrupted computers worldwide. Those episodes are background, not evidence that this breach caused similar disruption. [1]
References for this detail (1)
- Five things to know about North Korea's TraderTraitor hackersstraitstimes.com · Article published: Nov 1, 2026, 3:23 AM UTC
Context from the sources
TraderTraitor is described as a hacking operation linked to Lazarus and North Korea’s cyberwarfare programme. Its reported use of fake employment offers gives attackers a route into targets through social engineering rather than only technical exploitation. [1]
The theft has renewed attention on North Korea’s ability to generate revenue through illicit channels while facing international sanctions tied to its nuclear and missile programmes. [2]
Explore the sources and reporting timeline
2 source links · 2 domains
These counts describe the references, not independent confirmations. Different outlets can repeat the same original report.
Source timeline
Oldest to newest among the available source dates, not a chronology of the incident. Article publication dates come from the source; other recorded dates may reflect when a link was found.
- [1] Five things to know about North Korea's TraderTraitor hackersstraitstimes.comReferenced for: detail 4, detail 5
- [2] FBI: North Korea Linked to $6 Billion Cryptocurrency Heist - Jowhar News Leaderjowhar.comReferenced for: detail 1, detail 2, detail 3, detail 4
Questions answered by the reporting
How did the breach affect the wider crypto market?
The report said news of the breach triggered a broad selloff and sharply lower prices for major digital coins. [2]
What this could mean for you
Exchange customers may encounter renewed withdrawal restrictions or delays.
A large asset shortfall could pressure Binance’s ability to process withdrawals while recovery and replacement efforts continue.
Reported basis: [2] · The possible effect is interpretation.
Depends on: Binance’s stated recovery and replacement measures fail to cover affected assets or a further security problem emerges.
The value of crypto holdings may fall sharply across platforms.
A breach at a major exchange can trigger selling and weaken confidence in digital-asset markets.
Reported basis: [2] · The possible effect is interpretation.
Depends on: The reported selloff spreads or confidence in exchange security deteriorates further.
Other digital-asset users and companies may face more targeted fraud attempts.
TraderTraitor is described as using fake job offers and malware to steal access and assets.
Reported basis: [1] · The possible effect is interpretation.
Depends on: The same operation or imitators reuse those tactics against exchanges, employees or customers.
Possible time frame: months, if those conditions hold.
Possible consequences, not a forecast. Their relevance depends on your location and the conditions above.
For your country
Choose a country to check how this event could affect you.
What changes the outlook
Risk increases if…
Binance reports further withdrawal restrictions or cannot maintain its claim that 90% of stolen assets have been replaced.
Investigators link additional exchange compromises to the same TraderTraitor operation.
Pressure eases if…
Binance completes recovery or replacement of the remaining affected assets.
Market confidence stabilizes without further reported breaches tied to the incident.
Still unclear
The sources do not identify which Binance systems or accounts were compromised.
The sources do not establish whether all affected customers will ultimately recover their assets or how long market volatility will continue.
Market implications
Market impact
Sources (2)
References for the reported details. Separate links do not necessarily mean independent confirmation.
Available excerpt
Sign up now: Get ST's newsletters delivered to your inbox North Korea’s TraderTraitor hackers are blamed for a record US$6 billion Binance crypto theft. US…A short excerpt from our source record; open the original for the full article.
Available excerpt
After one of the largest known cryptocurrency thefts on record, Binance said it has resumed withdrawals as it works to recover from a hack that…A short excerpt from our source record; open the original for the full article.
First tracked by DoomRadar: . AI-assisted analysis · . Based on linked headlines and available excerpts. Methodology · Report an error.