FBI blames North Korea for $6.3 billion Binance crypto hack

What happened

The FBI said Saturday that North Korea was responsible for a theft of about $6.3 billion in cryptocurrencies from Binance on Thursday, which it described as the largest crypto hack on record. The bureau tied the attack to activity it calls TraderTraitor, the same actors it linked to a $1.5 billion Bybit hack last year. It said it worked with the U.S. Secret Service and IRS Criminal Investigation.^{⁠[1, 14, 17]}

The FBI said it had seen actors tied to the theft converting stolen tokens mainly into Ethereum and preparing further laundering through DeFi and instant-swap services. It urged crypto exchanges, analytics firms and other providers to block transactions involving wallet addresses linked to the stolen funds. Binance had frozen deposits and withdrawals after the incident.^{⁠[14, 17]}

Binance later said it had covered most of the loss from its own reserves and would reimburse customers, then resumed withdrawals in phases. President Trump, asked about the case, said, “I’m not concerned. We’re learning about it,” and that it was not yet certain North Korea was involved. Reports of customer outflows after withdrawals restarted ranged from about $3.6 billion to higher figures.^{⁠[1, 3, 5, 17, 19]}

Background

Binance is widely described as the world’s largest cryptocurrency exchange. North Korean state-linked groups have been accused in prior years of large crypto thefts, including the Bybit incident the FBI cited. Private researchers had already suggested a North Korea link before the FBI statement. Binance said it, not users, would absorb the financial impact of the stolen funds.^{⁠[2, 14, 17]}

How the coverage differs

Left-leaning outlets such as HuffPost, NPR and The Guardian led with the FBI’s North Korea attribution, the “biggest hack” framing, Trump’s comments, and investor withdrawals of about $3.6 billion. The New York Times similarly stressed outflows as normal trading resumed. Center outlets including PBS, ABC, Bloomberg, CNBC and Forbes repeated the FBI’s TraderTraitor finding and the Bybit parallel; some Bloomberg pieces also discussed North Korean hacking capacity and later, larger outflow estimates. Right-leaning Fox Business, the New York Post, The Wall Street Journal and The Washington Times highlighted the FBI attribution, conversion into Ethereum, and Binance’s claim that it had replaced most stolen assets (about 90% in some reports, roughly 95% in the Journal). Unrated outlets such as BBC, Al Jazeera, the Financial Times and TechCrunch focused on the restart of withdrawals and reimbursement.^{⁠[1, 2, 3, 5, 14, 17, 19]}

What's still unclear

How the attackers gained access, how much of the stolen crypto has been recovered or frozen, and the exact size of net outflows remain unsettled, with published figures differing. Binance’s stated coverage of stolen assets has been reported as about 90% or roughly 95%. Trump’s remarks conflicted with the FBI’s public attribution. Whether remaining tokens will be successfully laundered is unknown.^{⁠[1, 3, 10, 14, 17, 19]}

Written by Grok from the full articles, at a reader's request. AI can get details wrong; check the sources.