The FBI has identified North Korea as responsible for stealing approximately $6.3 billion in cryptocurrency from Binance, the world's largest cryptocurrency exchange, in an October 29 cyberattack that investigators say represents the largest cryptocurrency theft on record.

In a public alert, the bureau attributed the operation to a North Korean hacking group known as "TraderTraitor." Investigators said the hackers have been converting the stolen assets primarily into Ethereum, allowing the funds to move through decentralized financial services and making them more difficult to trace.

Federal authorities expect the stolen cryptocurrency to pass through additional exchanges and digital asset services as the hackers attempt to conceal its origins and launder the proceeds.

The FBI is working with the U.S. Secret Service and IRS Criminal Investigation to track the funds and disrupt the operation. The agencies urged cryptocurrency exchanges, blockchain analytics firms and other digital asset providers to block transactions involving wallets connected to the hackers.

The FBI also released a lengthy list of cryptocurrency addresses that investigators believe have held stolen funds or are associated with the North Korean operation.

Blockchain intelligence firm TRM Labs estimated that approximately $6.36 billion was transferred from Binance wallets across 10 different blockchains, with most of the theft occurring within roughly 20 minutes.

Binance said Friday that cooperation with law enforcement, blockchain companies and other industry partners had helped freeze approximately $3 billion in stolen assets. The exchange also pledged to cover the losses through its corporate treasury and Secure Asset Fund for Users.

"Binance will absorb the financial impact of these stolen funds, not our users," the company said in an October 30 security update.

The exchange reported that it had set aside more than $6.34 billion in corporate funds to cover the stolen assets, although efforts to replace some of the affected cryptocurrencies were still underway.

Binance temporarily suspended withdrawals while strengthening its security systems and investigating how the attackers gained access. An initial investigation pointed to a potentially compromised laptop, but the company later disclosed that investigators had identified additional points of intrusion. Binance said it had found no evidence that wallet private keys were leaked.

The breach has been attributed to the same North Korean operation linked to the February 2025 theft of approximately $1.5 billion from cryptocurrency exchange Bybit. In that attack, hackers moved the stolen assets across multiple cryptocurrency networks in an effort to complicate tracking and recovery.

North Korean hacking operations have repeatedly targeted the cryptocurrency industry, with stolen digital assets providing a potential source of revenue for the heavily sanctioned regime.

The FBI is asking anyone with information about the Binance breach or North Korean cryptocurrency laundering operations to contact a local FBI field office or submit a report through the bureau's Internet Crime Complaint Center at IC3.gov