Binance has pledged to cover customer losses while Trump has questioned whether Pyongyang is responsible.
The US Federal Bureau of Investigation (FBI) has accused North Korean hackers of stealing approximately $6.3 billion from Binance in the largest cryptocurrency heist on record. US President Donald Trump meanwhile, has stressed that Pyongyang’s involvement remains unproven.
In an alert published on Saturday, the bureau attributed the October 29 attack on the world’s largest crypto exchange to TraderTraitor, a group it claimed is related to North Korean malicious cyber activity and which it also blamed for last year’s $1.5 billion theft from Bybit.
Investigators said the attackers were primarily converting the stolen assets into Ethereum and would likely move them through cryptocurrency services to conceal their origins. The FBI urged exchanges and other providers to block transactions linked to hundreds of identified digital addresses.
Trump, however, stopped short of endorsing that scenario when questioned by reporters at his Mar-a-Lago estate on Saturday.
“We don’t know if it’s North Korea,” he said, adding that investigators were still examining the case. He indicated he would discuss the incident with Pyongyang if its involvement was established. Trump met North Korean leader Kim Jong-un several times during his first presidency and has since repeatedly touted their good personal relationship.
Binance’s preliminary investigation suggested that attackers accessed an internal system through a compromised employee laptop, allowing them to submit unauthorized withdrawals. The company said it had found no evidence that the private keys used to control its cryptocurrency wallets had been leaked.
The exchange suspended withdrawals after discovering the breach and worked with law enforcement, blockchain investigators, and other companies to freeze roughly $3 billion in stolen assets.
Binance says it has since replaced about 95% of the stolen assets using company resources, including its customer protection fund. The remaining tokens are less easily traded and take longer to acquire in the required quantities.
Withdrawals began resuming in stages on Sunday. The company warned of possible delays due to security checks and heavy demand.
There have been several other major penetrations of cryptocurrency platforms. Last week, prediction-market platform Polymarket disclosed a breach involving a compromised third-party provider, with at least $2.6 million taken from user accounts.
In September, hackers also stole around $388 million from the Bitget exchange. Attacks on the Drift Protocol and Kelp DAO platforms in April resulted in losses of $285 million and $292 million, respectively. In February 2025, suspected North Korean hackers stole around $1.5 billion from Bybit in what was widely described as the largest cryptocurrency heist on record at the time.
