FBI is involved in response to $6.3 billion Binance hack linked to North Korea

The FBI is working with government and industry partners after hackers stole an estimated $6.3 billion from cryptocurrency exchange Binance, an attack researchers have linked to North Korea.

“The FBI is aware of the incident and is engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts and coordinate appropriate investigative steps,” the bureau told Nextgov/FCW. It did not attribute the intrusions to North Korea.

Blockchain intelligence firm TRM Labs estimated that hackers transferred $6.36 billion out of Binance’s digital wallets Thursday, most of it in about 20 minutes. The company described it as the largest cryptocurrency theft on record, more than four times the $1.5 billion taken from rival exchange Bybit in February 2025.

TRM attributed the attack with high confidence to TraderTraitor, the North Korean hackers the bureau previously blamed for the Bybit theft.

Binance allows customers to buy, sell and hold digital currencies. The attack targeted wallets the company uses to handle those assets across multiple cryptocurrency networks. The company said its preliminary investigation suggests the breach began with a compromised laptop belonging to an engineer who works on its software and operations. The attacker then accessed an internal service and submitted withdrawals without authorization.

Earlier this year, the U.S. intelligence community assessed that Pyongyang has been able to net at least $1 billion annually in cryptocurrency heists and other financial crimes to fund its weapons programs.

“Decades of investment in cybersecurity have strengthened traditional defenses, yet the growing complexity of digital banking and AI have created new vulnerabilities,” said Phoebe Hodgson, a banking and payments senior analyst at GlobalData.

Binance said it temporarily halted deposits and withdrawals while conducting security checks. It pledged to cover all losses using its emergency protection fund and company money and said it would publish an updated accounting of the assets backing customer balances once repairs were complete.

Hackers can make stolen cryptocurrency harder to recover by exchanging it for other digital currencies and moving it between wallets. After the Bybit hack, the FBI said attackers had spread the stolen funds across thousands of wallets, and the bureau urged cryptocurrency companies to block further transfers.

North Korea has been stealing cryptocurrency for years as part of a broader effort to evade sanctions and raise money for the regime and weapons research. 

Its operations have also involved the use of false identities meant to obtain remote technology jobs. Earlier this month, U.S. authorities announced the disruption of “laptop farms” in Texas that helped DPRK operatives pose as U.S.-based employees and send their earnings back to the regime.