The FBI has joined a multi-agency effort to investigate a massive breach at cryptocurrency exchange Binance, where hackers moved roughly $6.3 billion from the platform’s wallets on Thursday.
Blockchain analytics firm TRM Labs reported that the transfers occurred within about 20 minutes, marking the largest crypto theft on record, surpassing the $1.5 billion loss suffered by rival exchange Bybit earlier this year.
TRM linked the operation with the North Korean group known as TraderTraitor, which U.S. authorities previously tied to the Bybit incident. The FBI’s statement confirmed awareness of the event and said it is coordinating with public and private partners to assess the scope and impact.
Investigation focuses on compromised internal access
Binance’s preliminary findings point to a compromised laptop belonging to a software engineer. Through that device, attackers accessed an internal service and issued unauthorized withdrawals from the exchange’s digital wallets.
Binance halted both deposits and withdrawals while it conducts security checks. The company pledged to cover all losses using its emergency protection fund and other corporate resources. It also promised to release an updated accounting of assets backing customer balances once remediation is complete.
U.S. intelligence estimates that North Korea extracts at least $1 billion each year from cryptocurrency thefts and related financial crimes to fund weapons development. A senior analyst at GlobalData noted that decades of investment in cybersecurity have strengthened traditional defenses, yet the growing complexity of digital finance and artificial-intelligence tools has created fresh vulnerabilities.
Analysts observe that the rapid movement of stolen coins across multiple wallets and conversion into other digital assets can hinder recovery efforts.
After the Bybit hack, the FBI warned that funds had been dispersed to thousands of wallets, urging crypto firms to block further transfers.
Law-enforcement agencies have previously disrupted “laptop farms” in Texas that enabled North Korean operatives to pose as U.S. employees and funnel earnings back to the regime. The current Binance incident highlights the ongoing challenge of securing cross-border digital finance infrastructure.
