The FBI said Saturday that hackers working on behalf of North Korea were responsible for the theft of more than $6 billion in cryptocurrency from Binance, the world's largest crypto exchange — the biggest digital asset heist ever recorded.
The bureau identified the intrusion as the work of "TraderTraitor," a North Korean cyber unit widely believed to be part of the Lazarus Group, the same outfit accused of hacking Sony Pictures in 2014. According to the FBI, the hackers struck Binance on Thursday and moved the stolen assets primarily into Ethereum. The announcement marks the first public confirmation from federal investigators of Pyongyang's role, following earlier private-sector assessments.
"The Federal Bureau of Investigation is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance," the bureau said in its statement, as reported by The Guardian.
The FBI said it worked alongside the U.S. Secret Service and IRS Criminal Investigation to track the movement of the funds, and it is now pressing crypto exchanges, blockchain analytics firms and other digital asset providers to block transactions tied to the wallet addresses linked to the theft. Chainalysis, a blockchain research firm, told Fox Business that the attackers have already used "thousands" of addresses and expects that number to keep climbing.
Binance disclosed the breach Thursday and initially pegged losses at roughly $6.3 billion. By Saturday, the exchange said it had replenished about 90% of the stolen assets — roughly $6 billion — covering Bitcoin, Ethereum, Tether and BNB in full while continuing to repurchase less-liquid tokens through market and over-the-counter transactions. Co-CEO Richard Teng said the company was "committed to covering the remaining 10%" and that "users will not bear the financial impact of this incident." Binance said the money came from its $1 billion Secure Asset Fund for Users, part of its Futures Insurance Fund and its corporate treasury. Withdrawals, suspended after the hack, have resumed in phases.
Markets reacted sharply. Bitcoin fell nearly 5% on the news, Ethereum dropped nearly 6%, and BNB also slid, according to The Guardian.
President Donald Trump addressed the breach Saturday, telling reporters the administration was still gathering information. "I'm not concerned. We're learning about it. We don't know if it's North Korea, but if it is, we'll talk to them about it," Trump said.
Ari Redbord, global head of policy at crypto research firm TRM Labs, which has helped Binance trace and recover some of the stolen funds, called it "the largest bank robbery in human history." Roughly $3 billion in stolen crypto has been frozen so far, according to NPR's reporting, though Binance has not confirmed that figure.
Eric Schiffer, chairman of Patriarch and Reputation Management Consultants, warned Fox Business that the breach could preview a wave of AI-driven cyberattacks against financial infrastructure.
It is not yet known exactly how the hackers breached Binance's systems. Teng described the operation as a "complex attack" involving a compromised laptop and malicious software built to erase evidence of its activity.
Our Take
So the FBI has now confirmed what private researchers suspected from the start: a hostile regime stole billions from an American-facing exchange and is laundering it through decentralized finance while Washington asks crypto firms to politely block some wallet addresses. That is not a strategy. That is a press release with a badge attached.
North Korea has been running a ransomware and crypto-theft operation against the West for years, and the response from the federal bureaucracy has been advisory after advisory. Meanwhile, the stolen Ethereum gets swapped through instant exchanges faster than investigators can publish new wallet lists. Chainalysis says thousands of addresses are already in play. Good luck blocking them one at a time.
What Americans should notice is who got hurt and who got bailed out. Binance tapped a billion-dollar customer protection fund and its own treasury to make users whole. That is what a responsible private company does. The lesson is not that crypto is broken — it is that critical financial infrastructure is now a battlefield, and the people guarding it are private firms, not the alphabet agencies that spent the last decade chasing the wrong targets.
Trump's instinct — "if it is, we'll talk to them about it" — is the right posture for a president who understands that Pyongyang only responds to strength. The question is whether this administration backs that talk with real consequences: sanctions that bite, cyber command operations that don't leak to the press, and a hard look at whether the deep state's intelligence apparatus is even capable of protecting American wealth from a regime that can't feed its own people. Patriots, watch what happens next — not what gets announced.
