The FBI said Saturday that North Korea's TraderTraitor hacking group stole more than $6 billion in virtual assets from cryptocurrency exchange Binance in an Oct. 29 incident described across industry reports as the largest crypto theft on record^2,5.

Binance, the world's largest crypto exchange by volume, estimated the impact at about $6.3 billion and said it would cover customer losses from reserve and company funds^1,6. On Saturday the company said it had already replaced 90% of the stolen tokens and would keep buying less-liquid assets until coverage reached 100%^1,2.

The bureau, working with the U.S. Secret Service and IRS Criminal Investigation, said TraderTraitor actors were converting stolen assets primarily into ethereum and were expected to move them through decentralized finance and instant-swap services^2,5. Agencies published addresses and asked virtual-asset firms to block related transactions⁵.

Blockchain intelligence firms TRM Labs, Chainalysis and Elliptic had already attributed the drain to North Korean operators, citing on-chain overlap with funds from a recent Bitget theft and tradecraft seen in the 2025 Bybit hack, which the FBI also blamed on TraderTraitor^3,4,7,8. North Korea has denied involvement in such attacks^1,9.

Binance said an initial inquiry pointed to a compromised DevOps engineer's laptop that let an attacker reach a service container and submit unauthorized withdrawals, with no evidence of a leaked wallet private key^3,4. Co-CEO Richard Teng later said investigators found additional breach points and that the attack used a self-destruct mechanism that erased tooling^1,5.

TRM Labs said an attacker moved about $6.36 billion out of Binance wallets on 10 blockchains, most of it in about 20 minutes starting at 20:05 UTC on Oct. 29, after at least 36 hours of staging and test deployments^4,8. The Hacker News, citing TRM, described a burst of pre-signed hot-wallet authorizations that swept a large ethereum-and-token balance⁷.

Stablecoin issuers including Tether and Circle, plus others named by TRM, froze on the order of $2.7 billion to $3 billion, mainly dollar-linked tokens^4,6,8. Tracing firms said attackers still controlled roughly $2.4 billion to $3.3 billion in bitcoin, ether and other native assets that issuers cannot freeze^4,7,8.

Elliptic noted that some laundering steps, including holding stolen USDT for tens of minutes before converting, differed from faster patterns in earlier North Korea-linked heists and said attribution should be treated with caution until a root cause is published^7,8.

Binance suspended deposits and withdrawals after the incident and said Sunday it had reopened those services after a security revamp^1,5. The company also published a new proof-of-reserves snapshot². How much of the unfrozen remainder can still be intercepted at exchanges remains unknown^5,8.