Photo via scmp.com
FBI blames North Korea for $6.3B Binance hack
The largest crypto theft in history hit the world's biggest exchange on October 29; Binance has already replaced 90% of stolen assets using company funds.
What happened
On October 29, 2026, attackers drained an estimated $6.3 billion from Binance hot wallets across ten blockchains in under four hours. The FBI on October 31 attributed the theft to TraderTraitor, a North Korean state-sponsored cyber unit that previously orchestrated a $1.5 billion attack on Bybit in February 2025. Investigators found the attackers used a compromised DevOps laptop and sophisticated wallet authorization techniques to bypass security systems. The stolen funds were rapidly converted to Ethereum and other assets, with approximately $3 billion frozen on-chain through swift action by stablecoin issuers Tether and Circle.
Binance responded swiftly, freezing user withdrawals and immediately pledging to cover all losses. On October 31, the exchange announced it had replenished 90% of the stolen assets using corporate treasury funds, its Secure Asset Fund for Users (SAFU), and futures insurance reserves. The remaining 10% consists of less-liquid tokens still being acquired through market purchases and over-the-counter trades. Binance confirmed that no user funds would bear the financial impact.
The FBI expects the stolen assets will continue to move through decentralized finance platforms and instant-swap services for further laundering before eventual conversion to fiat currency. The agency has issued alerts to crypto exchanges and node operators worldwide, identifying specific wallet addresses to block. TraderTraitor's operating pattern—rapid asset conversion, deployment across multiple blockchains, and quick stablecoin laundering—mirrors its Bybit attack and earlier North Korean crypto thefts.
Chanakya's Move
This was a coordinated strike by North Korea's state-sponsored cyber apparatus against the largest single chokepoint in the global crypto ecosystem. The move serves two strategic purposes for Pyongyang: immediate hard-currency acquisition (crypto laundering yields fiat for sanctions evasion) and demonstration of capability against US-aligned financial infrastructure. Binance's rapid and public commitment to cover 90% of losses within 24 hours is damage control aimed at preventing a bank-run on crypto deposits. However, the FBI's certainty in attribution to TraderTraitor—combined with the pattern of prior Bybit and other Lazarus Group attacks—signals to potential targets that attribution has improved. North Korea's counter-move will likely be operational security: mixing stolen assets across DeFi protocols, time-delaying conversions, and diversifying laundering routes. The real strategic test is whether other major exchanges now invest heavily in cold-wallet custody, which would reduce North Korea's target surface.