FBI links North Korean TraderTraitor hackers to $6bn Binance theft

North Korean hackers carried out the theft of more than $6bn from Binance, the world's largest cryptocurrency exchange, according to the FBI, in what researchers describe as the biggest attack ever mounted on a digital asset venue.

The US federal agency attributed the raid to TraderTraitor, a group it links to North Korean intelligence, and urged companies to block deposits and withdrawals tied to specific addresses so the stolen assets cannot be laundered. Blockchain analysis firm TRM Labs had already blamed the group, and said the attackers moved most of the $6.36bn within 20 minutes.

Binance suspended all deposits and withdrawals after the breach. The exchange said it would cover 90 per cent of the stolen sum itself, through measures including buybacks, and that withdrawals should resume from Sunday. "Binance will bear the financial impact of these stolen assets, not our users," the company said in a statement.

The incident dwarfs the previous largest exchange hack, in which about $1.5bn in digital currencies was taken from Bybit in early 2025 — an attack also attributed to North Korean hackers. The FBI's warning to block the flagged addresses is aimed at stopping TraderTraitor from converting the funds before exchanges and other firms can freeze them.

The scale of the loss puts the security of exchange custody back at the centre of the crypto industry's agenda, and hands regulators fresh evidence that state-linked actors now treat digital asset platforms as a primary target.