In a notice published Saturday, the bureau tied the attack, which took place on or about October 29, to TraderTraitor, its name for North Korean state-sponsored crypto theft teams.
The same group was blamed for the $1.5 billion Bybit hack in February 2025.
Binance estimated the loss at about $6.3 billion, while blockchain analytics firm Chainalysis put it at roughly $6.4 billion.
Markets reacted: bitcoin fell nearly 5%, Ethereum nearly 6% and Binance's BNB token nearly 10%, while shares of Coinbase, Strategy and Robinhood slid.
Suspected North Korea-linked actors now account for nearly 89% of reported crypto hack losses this year, up from 15% in 2021, which shows how the country raises money despite sanctions over its nuclear and missile programs.
President Donald Trump, asked about the case at a Halloween event, suggested investigators were not yet certain North Korea was involved, though he said that could change.
Binance says the attackers used a compromised laptop, reportedly belonging to a DevOps engineer, along with malware designed to erase its traces. Co-CEO Richard Teng said they manipulated a transaction-approval system to move funds out of an internet-connected "hot" wallet without passing normal approval controls, and the company says it found no evidence that wallet private keys leaked. Binance has set aside about $6.34 billion from its user-protection fund, futures insurance fund and corporate treasury to cover about 90% of affected assets, and says it will buy the remaining tokens until users are fully covered. Tether said it froze about $1.6 billion and Circle more than $800 million in USDC. Withdrawals were paused, and the company said they were on track to resume.
The FBI, working with the Secret Service and the IRS's Criminal Investigation division, says the thieves are mainly converting the loot into Ethereum and expects them to turn to decentralized finance (DeFi) platforms and instant swap services, which let people trade tokens without a traditional exchange account. It has published hundreds of Ethereum addresses and 19 bitcoin addresses and urged exchanges, swap services, DeFi platforms, node operators and analytics firms to block transactions involving them. Ari Redbord, chief policy officer at TRM Labs, expects the hackers to split the assets up and try to launder them through smaller exchanges over months, but said the funds can be traced in real time to support investigations and seizures.
