FBI Blames North Korea for Historic $6.4B Exchange Hack

The FBI, alongside multiple U.S. federal law enforcement agencies, has officially attributed last week's historic cryptocurrency exchange theft of more than $6 billion to North Korean state-sponsored hackers. The cyberattack, which drained hot wallets across approximately 10 blockchains within a 20-minute window on Thursday afternoon, prompted rapid regulatory intervention and triggered massive market outflows.

The FBI identified the perpetrators as the North Korea-linked group it refers to as "TraderTraitor," corroborating earlier findings by blockchain intelligence firms Chainalysis and TRM Labs. The Secret Service and IRS Criminal Investigation are heavily involved in the probe, with agents managing to identify and freeze a significant portion of the virtual assets within minutes of the breach.

Laundering operations began immediately. According to Chainalysis, the attackers initially routed more than $500 million through the Tron network, utilizing more than 1,000 addresses, over 3,000 deposits, and various decentralized finance protocols. The stolen funds were subsequently dispersed to fresh Bitcoin, Ethereum, and Solana wallets via cross-chain services including THORChain, Relay, Chainflip, and NEAR.

Operational Aftermath and Outflows

The targeted platform began restoring phased customer withdrawals early Sunday morning. In the first nine and a half hours of resumed operations, the exchange processed a net outflow of roughly $3.64 billion, as $4.649 billion left the platform against $1.01 billion in deposits. DefiLlama data indicated that more than $6 billion in total exited associated wallets within 24 hours of the reopening, while rival platforms OKX and Bybit recorded net inflows of about $450 million and $134 million, respectively.

The initial breach was traced to a compromised laptop belonging to a DevOps engineer. This entry point allowed the attackers to exploit 50 pre-signed authorizations to turn a hot wallet into a smart contract that emptied itself, executing the theft without leaking the platform's private keys. Company executives confirmed that approximately 95% of the impacted assets have been replenished, leveraging corporate funds and emergency reserves to cover the losses. Chief Executive Officer Richard Teng stated, "Binance will absorb the financial impact of the stolen funds, not our users." Furthermore, stablecoin issuer Circle froze more than $1.1 billion in USDC tied to the theft.

Market and Policy Impacts

The scale of the incident, more than four times larger than the previous record, a $1.5 billion theft in February 2025, has severely rattled institutional markets. Spot Bitcoin exchange-traded funds experienced $643.2 million in outflows during Friday's single trading session, entirely erasing the funds' net gains for the month of October. Discussing the incident, TRM Labs' Ari Redbord noted, "A hack at a crypto exchange is bank robbery at the speed of the internet."

U.S. regulators are pointing to the incident as evidence of the need for expanded oversight. Commodity Futures Trading Commission Chairman Michael Selig remarked that the event proves the agency's concerns over systemic vulnerabilities. "The real issue here is that these are unregulated offshore exchanges, and they don’t have the same sorts of safeguards," Selig stated. He pitched a federal option that would allow offshore trading venues to voluntarily register with the CFTC and adhere to established U.S. cybersecurity standards.