FBI blames North Korea for $6 billion Binance crypto theft

The latest:

More than $6 billion in virtual assets were taken from Binance on Thursday by North Korean hackers, the FBI said Saturday, in its first public attribution of the breach to Pyongyang. The bureau identified the activity as TraderTraitor and said the stolen holdings were being converted mainly into Ethereum. Binance, the world’s largest cryptocurrency exchange, has put its own loss estimate at about $6.3 billion.

Details:

• The attribution: The FBI said the intrusion was the work of North Korean cyber activity it tracks as TraderTraitor, the first confirmation by U.S. federal investigators of Pyongyang’s role. Private cybersecurity researchers had reached similar assessments before the bureau’s statement.
• The agencies: The FBI said it worked alongside the U.S. Secret Service and IRS Criminal Investigation, and that the three observed the hackers moving the stolen assets primarily into Ethereum rather than holding them in their original form.
• The laundering path: Authorities said they expect the funds to be laundered further through decentralized finance platforms and instant cryptocurrency exchange services, the routes that allow large holdings to be broken up and moved quickly across chains.
• The appeal to industry: Federal officials urged exchanges, blockchain analytics firms and other digital asset service providers to block transactions tied to wallet addresses linked to the stolen funds, in an attempt to freeze the money before it is dispersed.
• Binance’s response: The exchange said Saturday it had replenished roughly 90% of the stolen assets, about $6 billion of the estimated $6.3 billion loss, and that it would absorb the financial impact rather than pass it to users.
• What is covered: Binance said Bitcoin, Ethereum, Tether and BNB were fully backed, while it continued buying less-liquid tokens through market and over-the-counter transactions. The exchange did not say when that purchasing would be completed.
• The timeline: Binance first disclosed the breach on Thursday at roughly $6.3 billion in digital assets, temporarily suspending deposits and withdrawals, with founder Changpeng Zhao saying the incident appeared to be a hack.
• Trump’s reaction: President Donald Trump said Saturday his administration was still gathering information on possible North Korean involvement, telling reporters he was not concerned and that if Pyongyang proved responsible, the United States would raise it with them.
• The outside view: Eric Schiffer, chairman of Patriarch and Reputation Management Consultants, told FOX Business the breach ranks among the largest thefts ever recorded and warned of more sophisticated attacks as artificial intelligence advances. “I think the bloodbath of AI hacking is to come,” he said.

Background:

TraderTraitor is the label U.S. investigators use for North Korea-linked operations targeting cryptocurrency firms. Pyongyang has been tied by private researchers to a series of major exchange intrusions, with proceeds typically routed through mixing services and decentralized platforms before conversion.

Between the lines:

The gap between the FBI’s attribution and Trump’s hedging is the story’s live tension: one arm of the government has named Pyongyang, while the president says the evidence is still being assembled and frames any response as a conversation rather than a penalty. The appeal to exchanges to freeze linked wallets suggests investigators see the next days, not months, as the window to stop the money moving.

What’s next

Watch whether the White House matches the FBI’s attribution, whether exchanges and analytics firms act on the flagged wallet addresses, and whether Binance completes purchases of the remaining less-liquid tokens beyond the 90% already replenished.