FBI and Secret Service join Binance hack probe as Trump weighs North Korea link
US federal investigators are working with Binance to trace and freeze funds after the record $6.3 billion hack, as President Donald Trump said officials were still investigating whether North Korea was behind the theft.
The United States Federal Bureau of Investigation and the United States Secret Service are working with Binance after hackers stole a record $6.3 billion from the world's largest cryptocurrency exchange, a person familiar with the situation told Reuters, as the investigation into the largest crypto theft on record widened on Friday and Saturday.
Binance is cooperating with law enforcement agencies around the world, the source said, while the Secret Service said its investigators were working with private-sector partners, including cryptocurrency companies, to identify, freeze, trace and recover the stolen funds. The FBI said it was aware of the incident and was working with public- and private-sector partners to determine the scope of the hackers' activities and coordinate investigative measures.
The theft itself unfolded late on Thursday, when attackers drained Binance wallets across 10 blockchains, moving most of the money in about 20 minutes. Binance first traced the breach to a compromised DevOps engineer's laptop, which it said allowed an attacker to reach a service container and submit unauthorised withdrawal transactions, but its co-chief executive Richard Teng later said the investigation had uncovered additional points of breach and that the attack was not carried out by one person alone.
Blockchain analysis firms TRM Labs and Chainalysis have attributed the theft, with high confidence in TRM's case, to TraderTraitor, a North Korean hacking group previously blamed by the FBI for the $1.5 billion Bybit theft in February 2025. The firms pointed to transaction patterns and similarities with earlier North Korean operations, and Chainalysis also linked the stolen funds to proceeds from a separate exploit last month that had already been attributed to North Korea.
That attribution, however, has not yet been made by any government, and Binance itself has not named a culprit. President Donald Trump, speaking at the White House on Friday, said Binance had told officials it had the fallout from the hack pretty much under control, while adding that he had long felt digital money was a little bit dangerous. Asked whether the hack should be tied to a North Korean hacker group, he said authorities were not sure North Korea was behind it, but that officials were investigating.
The scale of the theft dwarfs previous crypto heists. TRM Labs put the haul at about $6.36 billion, Chainalysis at approximately $6.4 billion and Elliptic at $6.43 billion, while Binance itself has put the figure at around $6.3 billion and set aside more than $6.34 billion in company funds to cover user losses. For comparison, TRM counted $2.9 billion stolen across nearly 150 attacks in all of last year, meaning this single theft is more than double that annual total.
About $3 billion of the stolen assets had been frozen by Saturday, according to Binance, with stablecoin issuers including Tether and the Trump-backed World Liberty Financial freezing about half of the stolen funds. One analysis estimated that about $2.9 billion could still be moved, and that the attacker still held more than 420,000 ether and 18,270 bitcoin beyond any issuer's reach, underscoring how much of the recovery effort remains ahead.
Binance initially suspended all deposits and withdrawals, then said deposits had returned to normal on Friday while withdrawals remained suspended pending a revamp of the security of its withdrawal service. The exchange said withdrawals were expected back within about 45 to 48 hours, with Teng telling reporters he hoped to resume them by Sunday, 1 November, followed by a full proof-of-reserves report on Monday and a technical post-mortem.
Markets felt the shock quickly. The price of bitcoin fell 5 percent to $76,800 in Friday afternoon trading in New York, as traders weighed both the direct losses and the wider question of how a single compromised laptop could cascade into a multi-billion-dollar drain. Analysts also noted that the attackers were reported to have abused Ethereum's EIP-7702 account-delegation feature to take control of a hot wallet without going through Binance's normal approvals, a detail that, if confirmed, will shape the exchange's security overhaul.
What happens next now depends on three separate tracks: the criminal investigation by the FBI and Secret Service, the on-chain race to freeze funds before they are laundered beyond reach, and Binance's own promised transparency exercise. Until a government formally attributes the attack, the North Korea link remains an analysts' assessment rather than an official finding, but the sums involved have already made this the benchmark case for crypto security, regulation and state-linked hacking alike. Figures checked at 8:30 p.m. PKT on Saturday, 31 October 2026.
This post is market news information only, not financial advice.
