How much was stolen in the Binance hack?

The FBI cited a figure of $6.3 billion, making it the largest single digital-asset theft the U.S. government has attributed to a state actor.

What does an FBI attribution to North Korea change in practice?

It brings the stolen funds under OFAC's North Korea sanctions program. Any U.S.-touching exchange, bridge, or service provider that moves the funds risks secondary sanctions, which is why the bureau is asking venues to blacklist the associated addresses.

Were Binance user funds lost?

Binance previously said the bulk of impacted balances were covered from its SAFU reserve fund. The exchange has not published an updated statement in response to the FBI notice at the time of writing.

Who is Lazarus Group?

Lazarus is the umbrella name used by Western intelligence agencies for cyber units tied to North Korea's Reconnaissance General Bureau. The group has been linked to the Ronin Bridge, Harmony Horizon, Atomic Wallet, and WazirX exploits in prior U.S. and UN attributions.

FBI Attributes $6.3B Binance Hack to North Korea, Urges Exchanges to Freeze Linked Addresses

The FBI on Saturday formally attributed the $6.3 billion breach of Binance to hackers linked to North Korea, calling on cryptocurrency exchanges, DeFi platforms, and blockchain service providers to block transactions tied to the stolen funds. The bureau said the attribution followed a joint investigation with the U.S. Secret Service and the Internal Revenue Service's Criminal Investigation unit, per a public notice first reported by BitCoinist. It is the largest single theft of digital assets ever tied by U.S. authorities to a state actor.

By Elena Stojanović· AI-assisted· Regulation correspondent

What happened

The FBI confirmed on Saturday that the $6. 3 billion theft from Binance was carried out by hackers affiliated with North Korea, according to a public notice first reported by BitCoinist. The bureau said the attribution came out of a joint investigation with the U.

S. Secret Service and the Internal Revenue Service's Criminal Investigation division. It urged every cryptocurrency exchange, DeFi protocol, and blockchain service provider to block any transaction associated with the wallet addresses holding the stolen assets.

The notice did not name specific addresses in the material cited, but the bureau's prior Lazarus Group advisories have paired attribution statements with on-chain indicators within hours. Binance has not published a response to the FBI statement at the time of writing. The exchange previously framed the breach as the largest security incident in its history and said the bulk of impacted balances were covered from the firm's SAFU reserves.

Why it matters

A formal U. S. government attribution to the Democratic People's Republic of Korea changes the legal temperature around the stolen funds.

Once a flow is tagged to a sanctioned state actor, any U. S. -touching intermediary that moves it, knowingly or not, risks secondary sanctions under OFAC's North Korea program.

That is the lever the FBI is pulling with the blacklist request. Exchanges and bridges typically respond by freezing addresses within hours of a federal notice, as happened with Tornado Cash flows in 2022 and the Harmony Horizon drains in 2023. $6.

FBI Attributes $6.3B Binance Hack to North Korea, Urges Exchanges to Freeze Linked Addresses

What happened

Why it matters

Market impact

What to watch

Disclaimer

Key takeaways

Frequently asked

Sources