The Federal Bureau of Investigation has identified North Korea as being behind what it described as the “biggest hack in history,” after an estimated $6.3 billion was stolen from cryptocurrency exchange Binance, triggering an overnight crisis among its executives.
The investigation, conducted by the FBI alongside the US Secret Service and the Internal Revenue Service Criminal Investigation division, uncovered malicious North Korean cyber activity linked to the elite hacking group known as “TraderTraitor.”
Binance, the world’s largest cryptocurrency exchange by daily trading volume, said on Thursday that investigators had discovered “additional points of breach.” That finding contradicted the initial belief that the attack had originated from a single compromised laptop.
The company later said the estimated financial impact was “around $6.3 billion,” placing the incident among the most serious cryptocurrency security breaches ever recorded.
TraderTraitor is believed to operate as part of the Lazarus Group, which drew global attention in 2014 after being accused of hacking Sony Pictures in retaliation for The Interview, a film that mocked North Korean leader Kim Jong Un.
The Binance attack unfolded in real time, with billions of dollars flowing out of accounts on Thursday evening and cryptocurrency executives scrambling to respond.
People familiar with the aftermath described the chaotic response to the New York Times. Executives across several time zones joined late-night conference calls, analysts worked through the night in a lavish New York meeting room and industry founders posted urgent updates on X.
The FBI has confirmed that the historic Binance hack was carried out by “TraderTraitor,” a group linked to the hackers accused of targeting Sony Pictures in 2014 over The Interview, a film that mocked North Korean leader Kim Jong Un
Donald Trump pardoned founder Changpeng Zhao after he pleaded guilty to charges connected to his failure to prevent money laundering on the platform
Zhao, who no longer serves as Binance’s CEO but founded the company, posted a series of updates about the hack online
Despite the FBI’s conclusion, President Donald Trump appeared to question whether North Korea was responsible for the breach.
Asked about the investigation by a reporter at Mar-a-Lago on Friday night, Trump said his administration was still “learning about” the incident.
The president said he was “not concerned,” adding: “We don’t know if it’s North Korea — but if it is, we’ll talk to North Korea about it.”
Soon after the attack, Changpeng Zhao posted a series of anxious messages on X, telling followers: “It hurts, but we will survive.”
Staff at cryptocurrency analytics company Chainalysis rushed to a New York conference room named “Silk Road” and spent the night examining the breach.
Before the FBI released its findings, Chainalysis said the attackers had used “laundering patterns we have not seen before” and attributed the operation to TraderTraitor.
Chainalysis chief executive Jonathan Levin said he was on a video call with a senior US official discussing cyberattacks against US adversaries when he learned about the Binance hack.
Binance executives also convened a large conference call. He Yi, the company’s co-chief executive, joined the meeting from Abu Dhabi at 3am while seven months pregnant.
Zhao continued updating his followers throughout the crisis. He also criticized Elon Musk after Musk posted a grimacing emoji in response to a message mocking him, writing: “Bad time to troll. Please stop.”
READ MORE: Olivia Rodrigo Backs Former Ohio Health Director Amy Acton for Governor
Binance co-CEO Richard Teng said in a video message on Friday that the company was “working nonstop” and would “cover all hack losses.” He also assured customers that their “assets were safe.”
“This was a complex attack,” Teng said, explaining that the hackers had deployed a self-destruct mechanism that complicated efforts to trace their activity.
He added that Binance would carry out a comprehensive security review following the breach.
Trump appeared to question the FBI’s findings, telling a reporter that his administration did not “know if it’s North Korea”
TraderTraitor has a history of sophisticated, multibillion-dollar cyberattacks. The group became notorious in 2014 after the Lazarus Group, which the FBI believes includes the same hackers, stole internal data from Sony Pictures.
Officials said the attack was prompted by Sony’s release of The Interview. Kim Jong Un described the film as “an act of terrorism.”
In 2016, North Korean hackers launched an operation aimed at stealing $1 billion from the Federal Reserve Bank of New York.
The attempt failed after bankers noticed that the hackers had misspelled “foundation” as “fandation.”
US officials again accused the Lazarus Group in 2022, alleging that it had stolen $620 million in cryptocurrency from the video game Axie Infinity.
In 2025, TraderTraitor carried out what was then the largest cryptocurrency cyberattack on record, taking $1.5 billion from the Bybit platform.
The hackers gained access after deceiving chief executive Ben Zhou into approving what appeared to be a routine transaction, which opened the door to the company’s software.
Yi He, Binance’s co-founder, joined a call about the hack at 3am in Abu Dhabi. She is pictured with Zhao in 2017 after the pair launched Binance
Zhao posted frequent updates on X after the massive hack. Although he no longer leads Binance, he remains a shareholder
Zhao pleaded guilty in 2023 to charges linked to his failure to prevent money laundering at Binance. A courtroom sketch is shown above
Binance has also faced significant scrutiny from regulators. Zhao pleaded guilty to a felony related to his failure to prevent money laundering on the platform and stepped down as CEO in 2023. President Donald Trump pardoned him in 2025.
Zhao was released from prison in 2024 after being sentenced for violating the Bank Secrecy Act.
He became the first person to serve prison time for violating the law, which requires US financial institutions to identify their customers, monitor transactions and report suspicious activity.
Prosecutors said no one had previously violated the regulations on the scale alleged in Zhao’s case. Zhao and Binance have also been prominent supporters of some Trump family crypto enterprises.
Our News Outlet has contacted the White House and the FBI for additional comment.
