Trump Questions FBI Link Between North Korea and $6.3 Billion Binance Hack

US President Donald Trump has questioned the Federal Bureau of Investigation’s conclusion that North Korean hackers were responsible for an attack on Binance, the world’s largest cryptocurrency exchange, and the theft of about $6.3 billion, equivalent to more than €5.6 billion, from its customers.

The FBI said on Saturday, October 31, that North Korea was behind the incident. Trump struck a more cautious position on November 1 while answering reporters’ questions at his Mar-a-Lago estate in Florida.

“We are looking into it now. We do not know whether it is connected to North Korea, but if it is, we will discuss the matter with North Korea,” Trump said.

The disagreement introduces uncertainty into the US response to what authorities have described as the largest theft of cryptoassets. It also underscores the difficulty governments face when a cyberattack with potential geopolitical implications unfolds through a financial system built around pseudonymous wallets, rapid cross-border transfers and uneven regulatory oversight.

Attribution carries economic and diplomatic consequences

The FBI said the October 29 theft was conducted by North Korean hackers associated with the TraderTraitor group. According to the agency, members of the group typically convert stolen funds into Ethereum, or ETH, before laundering the assets, including through instant cryptocurrency exchange services.

The bureau urged companies involved in cryptoasset transactions to block transfers originating from wallets linked to TraderTraitor. Law enforcement authorities published a list of the relevant wallets in their press release, effectively asking private-sector platforms to help contain the movement of the stolen assets.

For policymakers, the distinction between suspected and confirmed state involvement is significant. A formal conclusion that North Korea was responsible could move the incident beyond the boundaries of corporate cybersecurity and financial crime, raising questions about sanctions enforcement, diplomatic engagement and the treatment of digital assets within national-security policy. Trump’s comments indicate that the administration is not yet prepared to endorse that conclusion publicly, despite the FBI’s statement.

The episode illustrates how crypto markets can transmit geopolitical risk directly into the financial sector. Digital assets can move between jurisdictions and services rapidly, while enforcement often depends on exchanges, trading platforms and other intermediaries identifying and freezing transactions. The FBI’s appeal to crypto companies shows that public authorities remain reliant on private infrastructure when attempting to disrupt illicit flows.

Binance reimbursement limits the immediate customer shock

Binance said on October 31 that it had reimbursed customers for 90% of the funds stolen in the attack. According to the company, it fully covered losses involving assets held in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC.

The remaining 10% consists of tokens outside the 10 largest covered assets. Binance said those tokens have lower liquidity, meaning that acquiring sufficient quantities to compensate customers in full will take more time.

The reimbursement has reduced the immediate financial impact on affected users, but the structure of the recovery also exposes a broader market vulnerability. Large, liquid digital assets can be purchased more readily when an exchange needs to replace stolen holdings. Less liquid tokens may be harder to source without delay, making compensation dependent not only on an institution’s balance sheet but also on market depth.

That distinction matters because Binance operates at a scale comparable to major global financial institutions. Estimates indicate that more than 300 million users worldwide are registered on the exchange. In 2024, the company said it had more than $160 billion in assets under management.

At that scale, a security failure is not solely an operational issue for one platform. It can affect confidence in digital-asset custody, intensify demands for stronger reserve and reimbursement arrangements, and increase pressure on regulators to clarify how globally active exchanges should manage cyber losses. The size of the reported theft also raises questions about whether existing safeguards have kept pace with the concentration of assets on major platforms.

A policy test for the expanding crypto economy

The contrasting messages from the FBI and the president create a near-term challenge for businesses assessing compliance and sanctions exposure. Crypto companies have been told to block transactions associated with identified TraderTraitor wallets, while the White House has publicly left the question of North Korean involvement unresolved.

For senior decision-makers, the longer-term implication is that digital-asset security is increasingly inseparable from macroeconomic governance and foreign policy. Large exchanges connect hundreds of millions of users, hold assets worth many billions of dollars and operate across regulatory borders. A breach can therefore generate simultaneous demands for customer protection, liquidity management, law-enforcement coordination and diplomatic judgment.

Whether the US government ultimately reaches a unified position on attribution will shape the next policy steps. For now, the FBI is pursuing containment through the crypto industry, Binance is continuing its reimbursement process, and Trump has reserved judgment while leaving open the prospect of direct discussions with North Korea.