The United States Federal Bureau of Investigation has attributed the theft of more than $6 billion in cryptocurrency from Binance to North Korean actors, providing the clearest public law-enforcement assessment yet of responsibility for the record-breaking cyberattack.
The announcement on Saturday, October 31, follows an extraordinary security breach at the world's largest cryptocurrency exchange, which disclosed that approximately $6.3 billion in digital assets had been affected.
According to Reuters, the FBI said North Korean actors had begun laundering the stolen assets by converting them into ether, the cryptocurrency associated with the Ethereum blockchain.
The agency expects additional laundering activity as investigators attempt to trace the stolen funds.
The attribution marks a significant shift from the earlier stage of the investigation, when cybersecurity companies suspected North Korean involvement but American officials had not publicly confirmed responsibility.
From suspected involvement to official attribution
In the hours following the breach, blockchain intelligence firms TRM Labs and Chainalysis identified similarities between the Binance attack and previous operations linked to North Korea's TraderTraitor hacking group.
Their assessments were based partly on the methods used to move stolen cryptocurrency between wallets and across blockchain networks.
At that stage, the findings represented expert attribution rather than a formal conclusion announced by US law enforcement.
On Friday, President Donald Trump said his administration was investigating the incident but had not established who was responsible.
The FBI's Saturday statement represents a material development because it publicly assigns responsibility to North Korean actors.
However, an intelligence or law-enforcement attribution should not be confused with a criminal conviction. No court judgment establishing individual responsibility was announced in the latest report.
How the attack unfolded
The Binance breach became public on October 29 after the exchange identified unauthorised transactions involving digital assets held in its systems.
Blockchain intelligence firm TRM Labs estimated that attackers moved approximately $6.36 billion across ten blockchains, with most of the transfers occurring within about 20 minutes.
Binance initially indicated that a compromised laptop belonging to a DevOps engineer may have been involved.
The company subsequently said investigators had identified additional possible points of compromise.
The complete technical mechanism remains under investigation.
Binance has said it found no evidence that the private keys protecting its cryptocurrency wallets were directly exposed.
Those findings are important but do not establish that every security weakness has been identified or resolved.
Stolen assets enter laundering channels
The FBI's latest findings focus partly on the movement of stolen cryptocurrency after the initial attack.
Digital assets can be transferred rapidly between wallets, blockchains and trading platforms, creating substantial challenges for investigators.
Although many blockchain transactions are publicly recorded, identifying the individuals controlling particular wallets can be difficult.
The FBI said North Korean actors were converting stolen assets into ether and warned that additional laundering stages could follow.
Such activity can complicate recovery efforts, particularly when funds move through services or assets that are harder to freeze.
Cryptocurrency exchanges and stablecoin issuers have already taken steps to restrict access to some of the affected assets.
However, the precise amount ultimately recoverable remains uncertain.
Binance moves to cover customer losses
Binance has pledged to cover the financial impact of the breach rather than pass the losses directly to affected customers.
The company said on October 31 that it had replenished approximately 90% of the stolen assets, using corporate resources and insurance-related reserves.
It has also said it intends to restore the remaining balances.
These are company-reported figures, not an independently audited confirmation that every affected customer has recovered access to all assets.
The exchange temporarily suspended withdrawals while carrying out security checks and said it expected to resume them on November 1.
That timetable remained prospective at the time of this report.
Why North Korea matters to the investigation
US authorities have previously linked North Korean cyber operations to major cryptocurrency thefts.
In 2025, the FBI attributed a roughly $1.5 billion theft from cryptocurrency exchange Bybit to North Korean actors associated with TraderTraitor.
Security researchers have repeatedly warned that digital-asset theft provides a potential source of foreign currency for North Korea, which faces extensive international sanctions.
The latest Binance incident is considerably larger than the Bybit attack.
Its scale has intensified questions about exchange security, transaction controls and the ability of international authorities to prevent stolen assets from entering wider cryptocurrency markets.
The FBI's attribution does not establish how the proceeds will ultimately be used.
Any claim that particular stolen funds have already financed specific weapons programmes would require separate evidence.
What happens next
Investigators are expected to continue tracking wallet movements and cooperating with cryptocurrency platforms, blockchain intelligence companies and international law-enforcement agencies.
Binance faces the additional task of demonstrating that its systems are secure enough to resume normal operations and maintain customer confidence.
The exchange has promised further technical information as its investigation progresses.
For customers and investors, the immediate questions concern the restoration of access to funds, the recovery of stolen assets and whether additional security failures will be disclosed.
The FBI's attribution is an important development, but the investigation is not complete.
The identities of individual attackers, the full technical method and the final financial losses remain matters requiring further confirmation.
