FBI Pins $6.3 Billion Binance Hack on North Korea's TraderTraitor as Withdrawals Reopen

Binance reopened bitcoin withdrawals on Sunday, 1 November, three days after a record $6.3 billion theft froze the world's biggest crypto exchange. The restart came hours after the FBI formally blamed the attack on North Korea's TraderTraitor hacking unit.

Binance also says it has now covered 95% of the stolen tokens with company money, up from the 90% it reported on Saturday, according to Reuters. The remaining 5% are less liquid assets that take longer to buy in the amounts needed.

What the FBI said

In an alert dated 31 October, the FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance "on or about October 29, 2026." The bureau calls this specific North Korean activity "TraderTraitor."

Working with the Secret Service and IRS Criminal Investigation, the FBI said it had watched the hackers convert stolen assets primarily into ether. It expects the funds to be "further laundered" through decentralized finance (DeFi) platforms and instant swap services.

TraderTraitor is the same group the FBI blamed for the $1.5 billion theft from Bybit in February 2025, Al Jazeera and Investing.com noted. Blockchain analytics firms had already pointed at North Korea before the official word, as we reported in our update on Binance replacing 90% of the stolen funds.

A blocklist of hundreds of wallets

The most practical part of the alert is a list of addresses. CoinDesk counted more than 600 Ethereum addresses, just under 20 bitcoin addresses and a single Solana address that have held funds from the theft.

The FBI, Secret Service and IRS-CI urged THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other crypto service providers to block transactions "with or derived from" those addresses.

That request goes straight at the laundering route. Stolen coins are usually swapped, split across many wallets and pushed through services that blur their trail before anyone tries to cash out. Our explainer on how crypto tumblers and mixers work covers one part of that pipeline.

Not everyone in Washington sounded as certain. "We don't know if it's North Korea — but if it is, we'll talk to North Korea about it," President Donald Trump told reporters on Saturday, in comments posted by a White House account on X, Reuters reported.

Pyongyang has for years denied using state-linked cyber units for financial theft. Its mission in Geneva and embassy in China did not respond to Reuters' requests for comment.

Withdrawals restart in phases

Binance posted on its status page shortly after 06:00 GMT on Sunday that withdrawals had begun, according to Reuters. The first phase covers 15 crypto assets, including bitcoin, ether, XRP and dogecoin.

Investing.com reported that the first window ran from 2 p.m. to 5 p.m. Singapore time, with more coins and networks to follow after security and stability checks. Binance said it would prioritise assets based on customer withdrawal demand over the previous week rather than switching everything back on at once.

Withdrawals had been halted since early Friday in Asia, after the breach was disclosed on Thursday. For most users, Sunday was the first chance in about three days to move funds off the platform.

Who is paying for the $6.3 billion

Binance has repeatedly said users will not bear the loss. It set aside around $6.34 billion of company funds internally and says it has already spent $6 billion buying replacement tokens, Reuters reported.

That money comes from three places: the $1 billion Secure Asset Fund for Users (SAFU), part of its Futures insurance fund, and the corporate treasury. Co-CEO Yi He said on Saturday that 50% of SAFU would be used, and the company has committed to topping it back up to about $1 billion.

Separately, Binance said about $3 billion of the stolen assets had been located with help from industry partners as of Friday, part of its effort to freeze affected funds.

Fellow co-CEO Richard Teng has described the breach as a "complex attack" involving a compromised laptop and malicious software designed to delete evidence of its activity. Investing.com reported that Binance has found no evidence that private wallet keys were exposed.

How the market is taking it

Prices have been calmer than the size of the theft might suggest. Bitcoin traded at about $77,820 early Sunday, up 0.76% on the day, Investing.com reported, roughly 5% below its Thursday high before the attack.

The wider mood is weaker. Bitcoin fell about 7.3% in October to close near $77,558, and the Crypto Fear and Greed Index dropped from 70 on 4 October to 36 by 30 October. U.S. spot bitcoin ETFs saw $643.3 million in net outflows on 30 October, their largest daily withdrawal of the month.

BNB, the token most closely tied to the exchange, edged up 0.21% to $705.23, while ether rose 1.13% to $2,267.82, according to the same Investing.com market snapshot.

Why it matters

Binance holds about $135 billion in assets, according to DefiLlama data cited by Investing.com, compared with roughly $29 billion at rival OKX. A smooth reopening at that scale would show that even a record hack can be absorbed without customers losing money.

The attribution matters as well. Attackers stole $2.9 billion in crypto across nearly 150 attacks last year, according to TRM Labs data cited by Reuters, and this single heist is more than twice that total. Security researchers had already warned that North Korean state hackers were stepping up attacks on the crypto industry.

What to watch next

The near-term tests are the rest of the phased withdrawal schedule and the final 5% of less liquid tokens. Binance has also published a new proof-of-reserves snapshot so users can check that their assets are backed at least 1:1, Al Jazeera reported.

On the enforcement side, the question is whether swap services and DeFi front-ends actually block the flagged addresses. If they do, the hackers' path to cash gets much narrower. If they don't, a large share of the stolen ether could be laundered before anyone has a chance to freeze it.