FBI Blames North Korea for Binance Heist as Exchange Restarts Withdrawals

The FBI has attributed the theft of more than $6 billion from Binance to North Korea, naming a state-linked operation it tracks as TraderTraitor. The bureau said the attack occurred on or about October 29.

Binance resumed bitcoin withdrawals on Sunday and said other withdrawals would return in phases, Reuters reported. The exchange said it had covered 95% of the $6.3 billion in stolen tokens.

The FBI said it, the Secret Service and IRS Criminal Investigation observed the stolen assets being converted mainly into Ethereum. The agencies urged exchanges, decentralized-finance services and blockchain analytics companies to block transactions tied to the theft.

Binance’s preliminary investigation said an attacker compromised a DevOps employee’s laptop and a service container, enabling unauthorized withdrawals. The exchange said wallet private keys were not leaked, put the loss at about $6.3 billion and said roughly $3 billion had been located and frozen.

AP described the attack as the largest cryptocurrency heist. President Donald Trump publicly questioned the attribution, saying the United States did not know whether North Korea was responsible; Binance’s technical account also remains preliminary.

The FBI’s attribution is official, but the public alert does not disclose the underlying intelligence. North Korea has historically denied accusations that it conducts cryptocurrency theft, and Reuters said its missions did not respond to requests for comment on this case.