FBI blames North Korea for record $6.3bn crypto heist

SaveSharefacebookxwhatsapp-strokecopylink[Dado Ruvic/Illustration/Reuters]By Al Jazeera Staff and ReutersPublished On 1 Nov 20261 Nov 2026The FBI has linked North Korea to the theft of a record $6.3bn in virtual assets from cryptocurrency exchange Binance.Malicious actors from North Korea were observed laundering the ⁠stolen assets ⁠by converting them primarily into the cryptocurrency Ethereum, ⁠the FBI said in a statement on Saturday.Recommended Stories list of 3 itemslist 1 of 3Netanyahu’s pitch: Can Israel use crypto to evade economic sanctions?list 2 of 3Tracking the money: The biggest donors in the 2026 US midterm electionslist 3 of 3Russia jails IT worker for 13 years for donating money to Ukraineend of listThe US agency blamed the operation specifically on a group called TraderTraitor, the same group blamed for a $1.5bn theft from the Bybit platform in February last year.According to the statement, the assets are expected to be “further laundered” in stages.The FBI called on virtual asset service providers to block transactions being used in the latest laundering operation, providing the suspected digital addresses to watch for.In a separate statement on Saturday, Binance said it has replaced 90 percent of the amount stolen by using company money to buy new tokens.The remaining 10 percent consists of less liquid tokens, meaning they ⁠may take longer to buy, it added.“We will continue to buy the remaining relevant token assets… until the covered amount reaches 100 [percent] for all tokens. Binance will absorb the financial impact of these stolen funds, not our users,” the company said on X. The money spent re-buying tokens came from a $1bn Secure Asset Fund for Users (SAFU), a Bitcoin reserve fund Binance ⁠holds to protect customers in the event of security ⁠breaches, as well as some of its Futures Insurance Fund and the company’s corporate treasury.Crypto prices fell on Friday, as Binance, which runs the world’s largest crypto exchange, sought to reassure customers their funds were safe.Binance co-CEO Richard Teng said on Friday that the breach was a “complex attack” involving a compromised laptop and malicious software designed to ⁠delete evidence of its activity, making it hard to trace and investigate.After ⁠the hack, the exchange stopped allowing customers to withdraw their funds.Binance said later on Saturday that it was on track to reopen withdrawals on Sunday.Binance also announced the publication of a new proof-of-reserves snapshot, allowing users to independently verify that their assets were backed at a minimum 1:1 ratio.