The FBI’s formal attribution of the record $6.3bn Binance hack to a North Korea-backed group has shifted attention to questions of oversight and accountability, after the exchange disclosed it has replaced 90% of the stolen funds. Binance, which suspended user withdrawals following the breach, said on Sunday that some withdrawals had resumed and would be rolled out in phases to ensure stability.
The FBI confirmed on Saturday what private investigators and analysts had earlier suspected: that a North Korea-affiliated group known as TraderTraitor was behind the attack, which the agency said took place on or about October 29, 2026. In a statement, the law enforcement agency said it was releasing information advising that the Democratic People’s Republic of Korea was responsible for the theft of more than $6 billion USD in virtual assets from the cryptocurrency exchange.
The attribution carries practical consequences for compliance and enforcement. The FBI said it had observed TraderTraitor actors converting stolen assets into Ethereum, and that it expected those assets to be laundered further through decentralised finance and instant swap services. It urged private sector entities to block transactions with or derived from addresses the actors are using to launder the stolen funds, an appeal that places direct responsibility on firms operating in the crypto sector to act on law enforcement guidance.
TraderTraitor is believed to be part of the Lazarus Group, an organisation that gained notoriety in 2014 when it was accused of hacking into Sony Pictures in revenge for The Interview, a film that mocked North Korean leader Kim Jong-un. The scale of the latest theft has put a spotlight on the capacity of North Korea, which faces extensive international sanctions over its nuclear and missile programmes, to find illicit means of capturing revenue.
For Binance, the immediate accountability question has centred on how it makes customers whole. Co-CEO Richard Teng said separately that the company was committed to covering the remaining 10% and that users would not bear the financial impact of the incident. In a post on X on Saturday, the company said the remaining tokens are less liquid, meaning they may take longer to buy. Teng had said on Friday that the breach was a complex attack involving a compromised laptop and malicious software designed to delete evidence of its activity, making it harder to trace and investigate.
The company said it had set aside around $6.34bn of company funds to cover the losses. Our commitment remains the same, it stated: Binance will fully cover the financial impact of the funds stolen in this incident. The money spent re-buying tokens came from using part of its $1bn Secure Asset Fund for Users, a bitcoin reserve held to protect customers in the event of security breaches, as well as some of its Futures Insurance Fund and the company’s own corporate treasury.
Meanwhile, the episode has fed a broader debate about security standards in the digital asset industry. The attack on Binance came as many observers express worries that the ever-expanding capabilities of artificial intelligence models could compromise cryptography and IT security protocols, raising questions about whether existing safeguards and regulatory frameworks can keep pace with evolving threats.
Markets reacted sharply to the news. Bitcoin plunged nearly 5%, Ethereum dropped nearly 6%, and BNB, the token native to Binance, tumbled nearly 10%, underscoring how a single breach at a major exchange can ripple across the entire sector.
As investigations continue, attention is likely to focus on two fronts: whether the FBI’s call for private firms to block transactions tied to the stolen assets is heeded across the industry, and how Binance completes its commitment to cover the remaining stolen funds. Further reporting on the case and the FBI’s attribution can be found at https://www.theguardian.com/business/2026/nov/01/binance-losses-covered-hack-fbi-north-korea-cryptocurrency. The outcome will be watched closely by regulators and oversight bodies assessing both the resilience of major crypto platforms and the enforcement challenge posed by state-linked theft at this scale.