FBI Accuses North Korea of Stealing $6.3 Billion from Binance

The FBI stated in a press release that the Democratic People’s Republic of Korea (DPRK) was responsible for stealing more than $6 billion in virtual assets from the Binance cryptocurrency exchange platform as of October 29.

U.S. investigators confirmed they have identified the entity behind the massive theft: a group of North Korean hackers known as “Trader Triathlete.” They also determined that the thieves were converting the stolen funds into Ether, the native cryptocurrency of the Ethereum network.

The statement noted that these assets are expected to undergo further laundering through decentralized finance (DeFi) services and instant exchange platforms, as part of additional money laundering stages. Decentralized finance refers to financial services operating on blockchain databases, while instant exchange platforms enable rapid conversion of one cryptocurrency into another without the need for traditional banks or intermediaries.

The FBI published a list of approximately 500 Ethereum addresses used by members of “Trader Triathlete” to launder the stolen assets, and urged cryptocurrency exchanges, DeFi services, and blockchain analytics firms to block transactions linked to these addresses.

Meanwhile, U.S. President Donald Trump, who frequently boasts of his personal relationship with North Korean leader Kim Jong Un, expressed doubts about Pyongyang’s involvement. Speaking to reporters at his Florida residence on Saturday evening, he said, “I’m not worried. We’re learning more. We don’t know if North Korea is responsible.”

According to the FBI, the amount stolen was four times greater than what the same group had previously seized from the Bitfinex platform in February 2025—amounting to $1.5 billion, which at the time was considered the largest cryptocurrency heist.

The scale of the hack targeting Binance demonstrates how North Korea, under international sanctions due to its nuclear and ballistic missile programs, continues to generate illicit revenue.

The “Trader Triathlete” group is part of the “Lazarus” group, which is linked to North Korean intelligence agencies. Lazarus gained notoriety in 2014 when it was accused of hacking Sony Pictures Entertainment in retaliation for the satirical film “The Interview,” which depicted North Korea.

According to a 2020 U.S. military report, North Korea’s cyber warfare unit, known as “Office 121,” comprises 6,000 personnel who also operate abroad, particularly in Belarus, China, India, Malaysia, and Russia.

Binance is the world’s largest cryptocurrency exchange by trading volume, with 335 million users.

The company announced on Saturday that its customers would be able to resume withdrawals starting Sunday, after suspending them following the hack to prevent further loss of funds.

Binance, which is tracking the stolen assets in collaboration with other entities in the cryptocurrency ecosystem, assured that its customers would not suffer any harm.

The company stated that it used its own funds to purchase digital tokens to compensate for 90 percent of the $6.3 billion stolen in the cyberattack.

On X (formerly Twitter), the company said, “Our position remains unchanged: Binance will fully cover all losses resulting from the stolen funds in this incident.”

Binance clarified that the remaining 10 percent of the digital tokens are “less liquid, meaning it may take longer to provide them in the required quantities.”

The cyberattack on Binance comes amid growing concerns from observers that the capabilities of AI models could jeopardize encryption and information security protocols.