FBI Says North Korean Hackers Stole $6.3 Billion From Binance in 20 Minutes - Latin Times

The attack began not with a sophisticated frontal assault, but with a single compromised laptop belonging to a DevOps engineer. This breach granted the attackers access to an internal service container, allowing them to push unauthorized withdrawal transactions across the exchange's infrastructure without triggering alarms.

Starting at approximately 8:05 p.m. UTC on October 29, the attackers began emptying Binance wallets spread across ten separate blockchains. Ethereum absorbed the heaviest blow at $3.8 billion, followed by 18,270 Bitcoin worth approximately $1.5 billion. A single transaction surpassed $2.5 billion in value on its own.

The precision and scale of the operation left little ambiguity about its origin. TRM Labs was first to publish a formal attribution, citing on-chain and off-chain intelligence showing that the attackers had made extensive preparations days before the theft, including collecting transaction signatures in advance.

Chainalysis co-founder and CEO Jonathan Levin independently reached the same conclusion, pointing to clear structural links between this attack and earlier TraderTraitor operations. On Saturday, October 31, the FBI made it official, confirming that TraderTraitor — also known as Lazarus Group, Jade Sleet and APT38 — was responsible for stealing more than $6 billion from Binance.

The FBI documented its observation that the group had begun converting stolen assets primarily into Ethereum, with the expectation of routing those funds through decentralized finance platforms and instant swap services to erase their trail. The bureau published linked wallet addresses and urged virtual asset service providers worldwide to block flagged transactions.

Binance absorbs the full blow

Confronting a potential collapse in user confidence, Binance moved aggressively from the moment the breach was detected. Working alongside stablecoin issuers and blockchain industry partners, the exchange managed to freeze approximately $3 billion in stolen funds before they could be fully dispersed.

Withdrawals were suspended as a protective measure, then restored in stages beginning Sunday morning. Between 6:00 a.m. and 3:30 p.m. GMT that Sunday, the platform processed $4.65 billion in withdrawal requests against $1.01 billion in deposits. By Monday morning, cumulative net outflows had reached $4.7 billion.

The exchange confirmed it had set aside $6.34 billion in company funds to absorb the entire impact of the theft, with a pledge that no user would bear any portion of the loss. By Saturday, Binance had already repurchased the equivalent of 90% of stolen tokens on the open market.

The remaining 10% — lower-liquidity tokens that cannot be quickly sourced — will take additional time to replace, though the company has not classified that portion as unrecoverable. The $4.7 billion withdrawn since the attack reflects not panic, but recalculation.

North Korea's crypto war machine

North Korea has transformed cryptocurrency theft into a pillar of state revenue, using stolen funds to compensate for the economic damage of international sanctions and to underwrite military development. Analysts estimate that roughly 40% of the proceeds from these operations are channeled directly into Pyongyang's nuclear and ballistic missile programs.

The pace of 2026's campaign is staggering on its own terms. TRM Labs reported that North Korea-linked hackers had already accumulated $7.4 billion in stolen crypto this year before the Binance incident — more than any previously recorded calendar year. The Bybit hack of February 2025, which at $1.5 billion was then the largest crypto heist in history, now reads as preparation for something far more ambitious.

Analysts have highlighted the growing use of artificial intelligence tools within North Korean hacking units, enabling faster reconnaissance, more convincing social engineering and more efficient laundering of stolen assets at scale.

Political dimension complicates response

A political dimension complicated the international response when President Donald Trump, speaking to reporters at the White House on October 30, publicly declined to endorse the FBI's preliminary findings. "We don't know," Trump told reporters when asked whether North Korea was responsible, adding that authorities were looking into the matter.

This statement diverged from the official attribution his own bureau would formalize the following day. The Binance episode forces the crypto industry to confront a risk it has long preferred to sidestep: no exchange, regardless of its size or financial depth, is immune to a state-level adversary operating with unlimited resources and no legal accountability.