A physical bitcoin. The FBI says North Korea's TraderTraitor group stole more than $6 billion from Binance on October 29. (File photo: Wikimedia Commons, CC BY 2.0)
In 60 seconds: The FBI has officially blamed North Korea for the record $6.3 billion theft from crypto exchange Binance — and Binance says it has already replaced 90% of what was stolen, with withdrawals due to reopen Sunday.
- The FBI says North Korea's TraderTraitor unit stole more than $6 billion from Binance on October 29 — the biggest crypto exchange heist on record.
- The hackers are converting the loot mainly into Ethereum and are expected to launder it through DeFi platforms and instant-swap services, the FBI warned.
- Binance has replenished 90% of the stolen assets from company funds and says major tokens are now fully backed.
- Withdrawals, paused since the hack, were targeted to reopen Sunday, November 1, pending final security checks — but had not been publicly confirmed resumed as of early Sunday.
Here's the thing: for two days, everyone in crypto suspected North Korea. Trackers said so, analysts said so, and the speed of the theft — most of $6.36 billion drained in about 20 minutes — had Pyongyang's fingerprints all over it. Now it's official, and Washington is asking the whole crypto industry to help choke off the money before it vanishes into decentralized finance.
What happened
On Thursday, October 29, hackers drained roughly $6.36 billion from Binance, the world's largest crypto exchange, according to blockchain analytics firm TRM Labs. Most of the money moved within about 20 minutes. Binance paused withdrawals, launched an investigation, and began buying replacement tokens with company money.
Binance's own account of the break-in starts with a single compromised laptop and self-deleting malware designed to wipe evidence. Investigators later found more breach points, turning what first looked like a one-laptop job into what co-CEO Richard Teng called a "complex attack."
Read our earlier coverage: Binance's $6.3 billion hack and the Polymarket breach — what we knew first.
Latest verified facts
On Saturday, October 31, the FBI issued a cyber alert, jointly with the U.S. Secret Service and IRS Criminal Investigation, stating that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29. The bureau attributes the attack to TraderTraitor, the same North Korean unit blamed for the $1.5 billion Bybit hack in February 2025.
Investigators say they have observed TraderTraitor converting the stolen assets primarily into Ethereum, and they expect "further laundering" through DeFi platforms and instant-swap services. The FBI asked exchanges, node operators, and DeFi services to block transactions linked to identified addresses.
On the money side, Binance said Saturday it has now replenished 90% of the stolen assets, up from about 80% a day earlier. It has set aside more than $6.34 billion in company funds, drawn from its corporate treasury, part of its futures insurance fund, and a partial deployment of its Secure Asset Fund for Users (SAFU). Co-founder Yi He said 50% of SAFU funds would go to covering the losses, and Binance committed to restoring SAFU to about $1 billion.
Binance says customer holdings of bitcoin, ether, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD, and Zcash are now fully backed at 100%. The remaining 10% is made up of less-liquid tokens the exchange is still buying on public markets and over the counter. About $3 billion of the stolen assets has been frozen on-chain, according to earlier BBC reporting.
Why it matters
Scale is one thing. Attribution is another. When TRM Labs and Chainalysis point at North Korea, that's analysis. When the FBI says it in a formal alert, that's the U.S. government putting its name on it — and it turns a crypto crime story into a national-security story. The same unit pulled off the Bybit heist last year; this one is more than four times bigger.
There's a second, quieter shift here too. Binance didn't wait for a bailout or freeze customer balances indefinitely — it bought its way out of the hole with its own reserves. If that holds, it's the strongest test yet of whether a giant exchange can absorb a catastrophic loss without passing it on to users. "Our users will not bear the financial impact of this incident," Teng posted on X.
Impact on the USA and the world
For Americans, the stakes aren't abstract. North Korea's crypto thefts are widely believed to fund its weapons programs and evade sanctions — so every successful laundering run has a geopolitical tail. The FBI's warning to DeFi platforms and instant-swap services is also a signal to U.S. regulators and exchanges: the choke points for this money are now the decentralized tools that were built to have no choke points.
For Binance's millions of users, the practical question is simpler: can I get my money out? Binance took a fresh proof-of-reserves snapshot at midnight UTC on October 31, showing coverage of 100% or more for the named tokens, with a full zero-knowledge proof — one that lets users verify their own balances — expected by November 3.
Related: Westpac will cap crypto transfers at A$10,000 a month from Dec. 1.
What happens next
Three dates matter now. First, Sunday, November 1: Binance's target for reopening withdrawals, subject to final security checks. As of early Sunday, the company had not publicly confirmed that withdrawals had actually resumed — so watch for that confirmation before assuming the gates are open. Second, Monday, November 2: Binance's full reserves report was due, per earlier company guidance. Third, November 3: the full cryptographic proof of reserves.
Meanwhile, the race is on between investigators and launderers. The FBI has published addresses it wants blocked; TraderTraitor's next moves will test whether DeFi's "unstoppable" plumbing can be stopped at all. Our take: the attribution was the easy part. Keeping $6 billion of stolen crypto from vanishing into a thousand wallets is the real test, and the next 72 hours will show whether the industry's defenses are real or decorative.
Frequently asked questions
Who does the FBI blame for the Binance hack?
North Korea's TraderTraitor unit, the same group blamed for the $1.5 billion Bybit hack in February 2025.
Has Binance covered the losses?
Binance says it has replenished 90% of the stolen assets from company funds and that its top ten tokens are fully backed. The remaining 10% is in less-liquid tokens it is still buying.
Can Binance users withdraw yet?
Withdrawals were targeted to reopen Sunday, November 1, pending security checks, but had not been publicly confirmed resumed as of early Sunday.
Sources: FBI cyber alert (October 31, 2026); Reuters; Associated Press; CoinDesk; TRM Labs; Binance statements on X; BBC.