Who is responsible for the $6.3 billion Binance heist?

The Federal Bureau of Investigation has formally concluded that North Korean state-sponsored cyber operatives were responsible for the theft of $6.3 billion in cryptocurrency from the Binance exchange. This operation marks the largest digital asset breach in history, according to reports from outlets including the South China Morning Post and Bloomberg. The FBI has issued a public warning to the broader decentralized finance community, urging exchanges and protocols to actively block specific wallet addresses associated with Bitcoin, Ethereum, and Solana linked to the incident.

The FBI has linked the historic $6.3 billion theft to North Korean state-sponsored actors, marking a significant escalation in the use of cyber heists to circumvent international sanctions.

How has Binance responded to the massive loss of funds?

Binance has successfully replaced 90% of the stolen digital assets, ensuring that individual user balances remain intact following the breach. As reported by the BBC and CoinDesk, the exchange is absorbing the significant financial impact of the hack by utilizing a combination of internal corporate funds, existing futures reserves, and the Secure Asset Fund for Users (SAFU). This rapid intervention is intended to maintain market stability and restore confidence among the platform's global customer base.

Watch: North Korea may be behind the Binance $6.3bn hack. Here's what you need to know | BBC News — BBC News

What is the current status of the stolen funds?

While the FBI has released a list of hundreds of wallet addresses connected to the theft, tracking the movement of these assets remains a massive logistical challenge. According to blockchain analytics firm Chainalysis, the perpetrators have already moved the stolen crypto across thousands of distinct addresses, and this number is expected to climb as the attackers attempt to obfuscate the trail. While the FBI has called for a coordinated block by DeFi platforms, the sophisticated obfuscation techniques employed by the North Korean actors continue to complicate recovery efforts.

NCAHUAC FBI file
NCAHUAC FBI file (Image: Wikimedia Commons)

What is the broader context of North Korean state-sponsored cybercrime?

The attack on Binance is not an isolated event but rather the most recent and significant development in a long-running campaign of digital heists attributed to North Korea. As detailed by The New York Times, international authorities have tracked multiple major thefts over recent years, noting that the regime increasingly relies on such illicit activities to bypass global sanctions and generate revenue. This record-breaking heist highlights the evolving security threats facing the cryptocurrency ecosystem, as state-backed entities leverage the pseudonymous nature of blockchain transactions to conduct large-scale financial operations.

Market Snapshot

AssetPrice24hMarket Cap
Bitcoin BTC$77,620+0.17%$1560.6B
Ethereum ETH$2,264+0.86%$276.6B
BNB BNB$703.99-0.48%$92.6B
XRP XRP$1.25-0.25%$79.4B
Solana SOL$95.71-1.06%$56.5B
Dogecoin DOGE$0.0758-0.44%$11.9B
Cardano ADA$0.193-1.25%$7.2B

Live data: CoinGecko — 2026-11-01 01:21 UTC