Trump says US would contact North Korea if it’s tied to the $6.3 billion Binance hack
- Published
- Updated
- Since then
- 14 new reports
- In
- Exchanges
Binance resumed withdrawals after freezing transactions following a theft that affected $6.3 billion in digital assets, and the FBI said North Korean hackers were behind the incident. The fallout spread from exchange operations to government responses, with South Korea summoning major exchanges and North Korean officials rejecting the accusation.
Key claims & sources
What it means
North Korea's state-linked hacking units, grouped by investigators under the Lazarus umbrella and now tied to a cell called TraderTraitor, have targeted crypto exchanges and bridges for years, including the 2022 Ronin bridge theft from Axie Infinity. Binance, the world's largest exchange by volume, had largely avoided a breach of this scale. The FBI's attribution, naming TraderTraitor and dating the theft to on or about 29 October, places this alongside Ronin as one of the largest state-linked crypto thefts on record.
Binance froze withdrawals, then reopened them once it had covered 95% of the stolen tokens, meaning most users recovered their holdings without waiting on recovery of the stolen funds themselves. South Korea's Financial Services Commission has summoned major exchanges to review security, a step that could tighten custody and monitoring rules across the country's trading platforms. Investigators tracking the stolen assets, converted mainly into Ether, now face a laundering trail running through DeFi protocols and instant swap services rather than regulated venues.
A state accused of running a hacking operation to fund itself through crypto theft turns an exchange breach into a sanctions and foreign-policy question, not just a security failure. Trump's offer to contact Pyongyang if the hack is confirmed treats a cyberattack as a matter for direct diplomacy, while Kim Yo-jong's dismissal of the FBI's case as a 'political provocation' leaves no admission to build enforcement on. Centralized exchanges remain the softest target even as blockchain analysis gets better at naming the attacker.
Chainalysis and blockchain trackers estimate laundering of the stolen funds, still carrying roughly $3.24 billion unlaundered, will take months as the tokens are split into smaller packages to resist tracing. Whether any of it surfaces on a sanctioned exchange or mixer will test how far US and allied enforcement can reach into DeFi and swap services. North Korea's continued denial, paired with its claim of 'no need' for US talks, leaves the diplomatic track Trump floated without an obvious next step.
Market reaction i
Coverage timeline
Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.
Thefts of a similar size
| When | What happened | Figure |
|---|---|---|
| 5.9 years ago | LuBian · Weak key generation incident | $3.5B |
| 5.5 years ago | Thodex · Scam incident | $2.5B |
| 5.4 years ago | Africrypt · Scam incident | $2.3B |
| 6.4 years ago | Wirecard · Scam incident | $2.1B |
| 5.2 years ago | BitConnect · Scam incident | $2B |
4280 incidents stored · 0 were as large as this one or larger ($6.3B)