The FBI has formally attributed the theft of more than $6 billion in cryptocurrency from Binance, the world’s largest crypto exchange, to North Korea. According to the Bureau, the attack was carried out by a North Korean group known as “TraderTraitor”. Binance puts the loss at about $6.3 billion and says the exchange, not its customers, will bear the cost. On Monday bitcoin held steady, although – as Bloomberg reports – traders are seeking protection.
What happened
Binance disclosed the breach on Thursday and temporarily halted deposits and withdrawals. Analytics firm TRM Labs estimates the attacker moved about $6.36 billion out of Binance wallets on ten blockchains, most of it in around 20 minutes. TRM attributed the attack “with high confidence” to TraderTraitor.
Binance co-CEO Richard Teng said initial findings suggest the incident “may have started with a compromised DevOps engineer’s laptop”, which gave access to a service container used to submit unauthorised withdrawals. Binance said deposits were not affected and that bitcoin, ether, tether and BNB remain fully backed.
The FBI said it is working with the US Secret Service and IRS Criminal Investigation. It expects the funds to be laundered through DeFi platforms and instant exchange services, and urged exchanges and blockchain analytics firms to block transactions linked to the wallet addresses used in the theft.
Binance: we will absorb the losses
According to Fox Business, Binance has already replaced about 90% of the stolen assets – roughly $6 billion of the $6.3 billion. “Binance will absorb the financial impact of these stolen funds, not our users,” the exchange said. US President Donald Trump said his administration was still gathering information and that, if North Korea’s involvement is confirmed, Washington would “talk to them about it”.
What it means for Poles in the UK
Our view: customers did not lose this time, but that was the exchange’s decision, not a legal guarantee. In the UK most cryptoassets are not covered by the Financial Services Compensation Scheme (FSCS), which protects bank deposits up to the statutory limit, and most crypto complaints fall outside the Financial Ombudsman Service. The FCA has long warned that people investing in crypto should be prepared to lose all their money. If an exchange lacks the capital to cover a theft, customers are left with a claim against a company that is often registered outside the UK.
The evidence: the scale and speed of the attack. About $6.36 billion was moved across ten blockchains, mostly within 20 minutes. The blockchain itself was not broken. According to Binance, the attack began with a single employee’s computer. The weakest link is people and company infrastructure, not the cryptography.
Practical takeaways
- Don’t keep everything on one exchange. Long-term holdings can be moved to your own wallet (e.g. a hardware wallet), but then full responsibility for keys and the recovery phrase is yours.
- Secure your account: app- or hardware-key-based two-factor authentication (not SMS) and a withdrawal address whitelist.
- Beware of scammers. High-profile hacks are followed by fake emails and texts about “refunds” or “post-incident account verification”. Binance does not need your recovery phrase or password. In the UK, suspicious texts can be forwarded to 7726 and emails to [email protected].
- Check FCA registration. The FCA Financial Services Register is free and online.
- Keep records. HMRC requires records of crypto transactions for Capital Gains Tax; they also help in any dispute with an exchange.
This article is for information only and is not investment advice.
Sources:
- Fox Business – FBI says North Korea stole over $6 billion in Binance hack, 1 Nov 2026
- ABC News 4 / Sinclair – TRM Labs data and Richard Teng statement, 30 Oct 2026
- FBI – North Korea Responsible for $6 Billion+ Binance Attack
- Bloomberg – Bitcoin holds steady after Binance hack, 2 Nov 2026
- Anadolu Agency – Morning Briefing (Donald Trump remarks), 2 Nov 2026
We assess factual corrections and substantive responses. Verified changes are reflected in our reporting.
Contact the editorial desk →
