The FBI has identified a North Korean-linked hacking unit as responsible for the theft of more than $6 billion in cryptocurrency from the global trading platform Binance. The agency reports that the attackers converted stolen Bitcoin into Ethereum and are actively moving the funds through thousands of digital addresses to evade detection, a tactic the FBI classifies under its "TraderTraitor" cybercrime designation, as reported by nos.nl.
Binance Addresses $6.3 Billion Security Breach
Binance, the world’s largest cryptocurrency exchange, has confirmed a massive security incident resulting in the theft of approximately $6.3 billion in digital assets. In a statement posted to X, the company described the breach as a "complex attack" that involved more than just a single point of failure.
To stabilize the platform, Binance has frozen billions in crypto assets and temporarily halted withdrawals. The exchange stated it has set aside $6.3 billion in company funds to cover the losses, with $5 billion held in the specific digital currencies impacted by the theft. Mede-eigenaar Richard Teng affirmed that the company has already reimbursed 90% of affected users and intends to compensate the remaining 10%, asserting that "users will not suffer financial damage from this incident."
Hackers' Evolving Cyber Tactics
The FBI’s attribution links this incident to the same state-sponsored actors behind the February 2025 hack of the exchange Bybit, where $1.5 billion was stolen. Joost Grunwald, an ethical hacker at the firm Edufort, suggests the attackers likely spent days inside the network undetected, mapping vulnerabilities before executing the final transfer of funds.
Market Impact and Regulatory Context
The news of the historic theft triggered a sharp decline in cryptocurrency valuations, with Bitcoin dropping nearly 5% and Binance’s own BNB token falling by roughly 10%. Tether and Circle, issuers of major stablecoins, acted to block approximately $1.6 billion and $800 million in assets, respectively, to prevent the hackers from liquidating the stolen funds.
The exchange withdrew from the Dutch market in 2023 after failing to secure a license from the Dutch central bank (DNB). Experts cited by nos.nl noted that because of this withdrawal, few Dutch residents were active on the platform at the time of the breach.
Frequently Asked Questions
How did the hackers gain entry into Binance?
While the exact method remains under investigation, the company identified a compromised employee laptop as an initial point of entry but later confirmed that multiple security vulnerabilities were exploited during the multi-stage attack.
Is my money safe on a regular bank account?
Yes, according to industry experts, European banks are subject to stringent, mandatory cybersecurity testing and oversight that distinguish them from crypto trading platforms. Unlike the volatile environment of crypto exchanges, traditional bank deposits in the Netherlands are protected by a deposit guarantee system.
What is the "TraderTraitor" method?
It is a term used by the FBI to describe the operational tactics of North Korean hackers who move stolen cryptocurrency rapidly across thousands of different digital addresses to obscure the trail and complicate recovery efforts.
What remains unknown about the theft?
The specific technical details of how the hackers bypassed the exchange’s multi-layered security defenses are still not fully understood, and the final timeline for when all users will be fully compensated remains subject to the company’s internal progress.