Binance, FBI attributes theft of over $6 billion to North Korea

The FBI has attributed to North Korea the theft of over $6 billion in virtual assets stolen from the Binance exchange platform. According to the US federal investigative agency, the theft occurred on October 29, 2026. The account is confirmed by three independent sources: the FBI, the federal investigative authority; Binance, the affected platform; and Associated Press, which cites the FBI and security expert sources.

Binance stated that its digital custody systems were compromised at 20:05 UTC on October 29. The platform estimates a total loss of approximately $6.3 billion in tokens, a figure slightly higher than the $6 billion indicated by the FBI. Binance further specifies that approximately $3 billion has been frozen directly on the blockchains, an operation that reduces the actual extent of the damage suffered by users.

Associated Press, citing cybersecurity expert sources, describes the episode as the largest cryptocurrency theft ever recorded, noting that the entire operation would have taken place within a matter of minutes. The speed of the attack, according to the agency’s account, made it difficult for the platform to intervene immediately before a substantial portion of the funds left the compromised wallets.

The FBI’s attribution to a state actor places the episode in a different category from ordinary cybercrime: this is a formal accusation by one state against another, made by a primary investigative authority rather than a mere journalistic reconstruction. The discrepancy between the two figures reported — over $6 billion according to the FBI, approximately $6.3 billion according to Binance — reflects distinct calculation methodologies between the federal investigation and the platform’s internal accounting, without the two sources being in substantial contradiction with each other.

Of the approximately $6.3 billion stolen, Binance states that approximately $3 billion has been frozen on-chain, while the remaining portion of the funds remains, as of the information currently available, outside the control of the platform and the authorities involved in the investigations.