FBI Attributes $6.3 Billion Binance Crypto Theft to North Korean ‘TraderTraitor’ Hackers

WASHINGTON — The FBI said Saturday that North Korean hackers were responsible for stealing more than $6 billion in cryptocurrency from Binance this week, linking one of the largest digital asset thefts on record to the regime in Pyongyang.

The announcement is the first public confirmation from U.S. federal investigators of North Korea’s role in the attack, following earlier assessments from private cybersecurity researchers.

The FBI identified the activity as “TraderTraitor,” saying the hackers stole more than $6 billion in virtual assets from Binance, the world’s largest cryptocurrency exchange, on Thursday.

The bureau said it and partners at the U.S. Secret Service and IRS Criminal Investigation observed the hackers converting the stolen assets primarily into Ethereum (ETH). Authorities expect the funds to be laundered further through decentralized finance (DeFi) platforms and instant crypto exchange services.

Federal officials are urging exchanges, blockchain analytics firms and other digital asset service providers to block transactions tied to wallet addresses linked to the stolen funds, a move intended to keep the hackers from moving or laundering the assets.

President Donald Trump addressed the breach Saturday, saying his administration was still gathering information about possible North Korean involvement. “I’m not concerned. We’re learning about it. We don’t know if it’s North Korea, but if it is, we’ll talk to them about it,” Trump told reporters.

Binance said Saturday it had replenished approximately 90% of the stolen assets, covering roughly $6 billion of the estimated $6.3 billion loss. The exchange said major cryptocurrencies — including Bitcoin, Ethereum, Tether and BNB — were fully backed, and that it continued purchasing less-liquid tokens through market and over-the-counter transactions.

“Binance will absorb the financial impact of these stolen funds, not our users,” the exchange said.

Binance first disclosed the breach Thursday, saying hackers had stolen approximately $6.3 billion in digital assets.

The Numbers Behind the Story

The gap between the FBI’s “more than $6 billion” figure and Binance’s $6.3 billion estimate reflects the fluid nature of crypto theft: the value of stolen tokens shifts with market prices, and the mix of assets recovered versus repurchased changes by the hour. Binance’s claim that it has covered 90% of the loss leaves roughly $300 million to $600 million still to be made whole, depending on which figure is used. That shortfall matters less to retail customers — who the exchange says are fully backed on major tokens — than to holders of thinly traded altcoins, where liquidity is scarce and replacement purchases can move prices.

The FBI’s decision to name Ethereum as the primary conversion asset is significant. ETH’s deep liquidity and broad trading pairs make it easier to obfuscate trails than smaller tokens, which is why investigators are pressing exchanges to freeze linked addresses quickly.

Who Wins and Who Loses

For Binance, the episode is a reputational and balance-sheet test. Absorbing a multibillion-dollar hit without passing losses to users protects its franchise in the short term, but the cost of buying back less-liquid tokens through over-the-counter desks could be steep. For U.S. investigators, the public attribution is a pressure tactic aimed at cutting off North Korea’s access to global exchanges. For DeFi platforms and instant swap services, the FBI’s warning is effectively a compliance demand: screen the listed addresses or risk being treated as a laundering channel.

The political dimension is equally pointed. Trump’s remarks — that he is “not concerned” and that Washington would “talk to them” if North Korea is confirmed responsible — suggest the administration is not yet prepared to announce a response. The FBI’s attribution, issued the same day, effectively answers the question the president left open.

What Happens Next

The focus now shifts to chain analytics firms and exchanges, which will be judged on how fast they freeze the flagged wallets. North Korea’s crypto operations have historically converted stolen funds through mixers and peer-to-peer services, and the FBI’s public list of addresses is designed to shrink that runway. Binance’s remaining repurchases, meanwhile, will be watched for signs of stress in thinner tokens.

Eric Schiffer, chairman of Patriarch and Reputation Management Consultants, told FOX Business the incident underscores growing cybersecurity challenges facing major financial institutions. “I look at this as one of the world’s greatest thefts of all time, and it’s sad,” Schiffer said. He warned that the attack could foreshadow a broader wave of sophisticated cyberattacks as artificial intelligence grows more powerful. “I think the bloodbath of AI hacking is to come,” he said. “And there’s going to be a lot more pain.”