North Korea Responsible for $6bn Binance Hack, FBI Says as Exchange Resumes Withdrawals

The United States Federal Bureau of Investigation (FBI) has accused North Korea of orchestrating a cryptocurrency theft involving more than $6 billion from Binance, as the world’s largest digital asset exchange by daily trading volume begins restoring customer withdrawals.

The massive security breach, considered potentially the biggest cryptocurrency heist ever recorded, sent major digital currencies tumbling on Friday as news of the attack spread across the market.

Binance initially halted withdrawals following the incident but announced that it would gradually restore access to affected networks. The first stage of the reopening process began on Sunday.

“First batch network now opened in phase one of withdrawals,” the cryptocurrency exchange said in a post on X.

The company has also pledged to bear the full financial cost of the incident, disclosing that it has committed corporate funds to replace the stolen assets.

According to Binance, approximately 90 per cent of the stolen tokens have already been replenished through purchases made with company funds.

The FBI, in a statement issued on Saturday, directly linked the attack to North Korea, backing previous assessments by independent investigators and analysts who suspected the involvement of TraderTraitor, a hacking group associated with Pyongyang.

TraderTraitor was previously blamed for stealing $1.5 billion from the Bybit cryptocurrency exchange in February last year.

“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026,” the agency stated.

The FBI said its investigations showed that “TraderTraitor actors” had been converting the stolen cryptocurrency into Ethereum.

It warned that the hackers were expected to continue moving the funds through decentralised finance platforms and instant cryptocurrency swap services in an attempt to conceal their origin.

The agency subsequently called on private sector organisations to help prevent the movement of the stolen assets, urging them “to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.”

Despite the FBI’s position, US President Donald Trump said there was no certainty that North Korea was behind the attack.

“I’m not concerned. We’re learning about it. We don’t know if it’s North Korea,” Trump told journalists at his Florida residence late Saturday.

The US president has previously spoken with pride about his meetings with North Korean leader Kim Jong Un during his first term in office.

Binance Pledges to Fully Cover $6.34bn Losses

In a separate announcement on Saturday, Binance revealed that it had made more than $6.34 billion in company funds available to cover the losses associated with the security breach.

“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the company stated on X.

It explained that 90 per cent of the stolen assets had been replaced using company money, while the remaining 10 per cent involved less liquid tokens that could require additional time to obtain in the necessary quantities.

Binance also said it would reopen withdrawals in stages, initially targeting a window between 0600 and 0900 GMT on Sunday.

“We are taking a phased approach by prioritizing tokens based on the past week data of user demand, so that each network and asset pair can be restored carefully, with stability and security checks completed before access is reopened,” it said.

The cyberattack comes amid growing concerns over whether increasingly sophisticated artificial intelligence models could weaken existing cryptographic systems and information technology security measures.

Financial markets reacted negatively to the news, with Bitcoin losing nearly five per cent of its value, Ethereum declining almost six per cent and Binance’s native BNB token falling by approximately 10 per cent.

The incident has also drawn renewed attention to North Korea’s alleged reliance on cybercrime to generate revenue amid extensive international sanctions targeting its nuclear and missile programmes.

TraderTraitor is believed to operate under the wider Lazarus Group, which became notorious in 2014 after being accused of hacking Sony Pictures over “The Interview,” a movie that made fun of North Korean leader Kim Jong Un.

Africans Angle News