FBI Attributes Binance Heist of $6.3 Billion to North Korea
Seven Lights
The Federal Bureau of Investigation has attributed the theft of $6.3 billion in digital assets from the cryptocurrency exchange Binance to North Korea, Bloomberg reported, confirming the suspicion that has hung over the largest cyber heist on record since it began.
Blockchain intelligence firms had already linked the theft to North Korea’s elite hacking unit, NPR reported, and the Guardian reported that North Korea was the likely culprit, with about $3 billion of the stolen assets located so far. Binance said on Thursday that $6.3 billion of digital assets had been affected, the biggest crypto hack believed in history.
The exchange suspended deposits and withdrawals “as a precaution” while its security teams checked systems, secured wallet infrastructure and traced affected assets, and said it would cover every customer loss, setting aside $6.34 billion against the stolen assets. When normal transactions resumed, customers moved quickly for the exits: Binance reported $3.64 billion in outflows, the New York Times said. Bitcoin fell 5 percent within hours of news of the hack breaking in early Asian trading.
The Times reported that the attack marked a dangerous turn for the industry, with attackers increasingly using artificial intelligence and other advanced techniques to steal crypto and launder the funds rapidly. The Wall Street Journal, citing people familiar with the episode, said hackers had made off with at least $6.3 billion in 20 minutes. Binance’s founder, Changpeng Zhao, had warned a week earlier that “no crypto wallet is 100% safe.”
Binance, the world’s largest crypto exchange, was founded by Mr Zhao, a Chinese-born entrepreneur now a Canadian and Emirati citizen, who was jailed for four months in 2024 after pleading guilty to money-laundering violations and was pardoned by President Trump in 2025.
The bureau’s attribution sharpens the diplomatic dimension of the loss, which rivals any state-sponsored theft on record. Binance said its tracing efforts continued with law enforcement and industry partners, and that the suspended-asset figure could change as the investigation proceeded.