Skip to content
Skip to content

Independent e-magazine

the OUTSPOKEN digest

FBI Blames North Korea for the $6 Billion Binance Theft as the Exchange Says 90% Is Replenished

The bureau named the TraderTraitor group on Saturday and asked the industry to block hundreds of laundering addresses, while Binance said it was on track to reopen withdrawals on Sunday.

Outspoken Digest Crypto Desk

Saturday, October 31, 2026/3 min read

The J. Edgar Hoover Building, the FBI's headquarters on Pennsylvania Avenue in Washington, seen across the road junction with trees in leaf, photographed on 21 June 2024, a file photograph of the bureau's headquarters and not of the Binance investigation
Photo: ajay_suresh via Wikimedia Commons (CC BY 2.0)

Two days after the largest theft in crypto's history, the United States government put a name to it. The FBI said on Saturday that North Korea was responsible for taking more than $6 billion in virtual assets from Binance on or about 29 October, attributing the operation to the state-backed unit it tracks as TraderTraitor, Reuters reported via NBC News.

The attribution matches what TRM Labs and Chainalysis said on Friday, and it arrived as Binance moved to reopen the withdrawals it froze on Thursday night. Our timeline of the hack has the full sequence to Friday afternoon.

What did the FBI say about the Binance hack?

The bureau's alert, issued jointly with the Secret Service and IRS Criminal Investigation, said investigators had watched the thieves converting the stolen assets mainly into ether and expected further laundering through decentralised finance platforms and instant swap services. It asked exchanges, node operators, analytics firms and other virtual asset providers to block any transaction touching the addresses TraderTraitor is using. The same group was blamed for the $1.5 billion Bybit theft in February 2025.

Binance's co-chief executive Richard Teng has described the breach as a complex attack that started from a compromised laptop and used malicious software designed to delete evidence as it went. The exchange has said a DevOps engineer's machine was used to reach a service container and submit unauthorised withdrawals.

Not everyone in Washington was ready to point at Pyongyang. Asked about the hack at Mar-a-Lago on Saturday, President Trump said he was not concerned and that the administration was still learning about it. "We don't know if it's North Korea," he said, adding that if it was, the US would talk to North Korea about it, the Korea Times reported.

How much of the stolen money has Binance replaced?

Ninety percent, by its own account on Saturday, up from 80 percent on Friday. Teng said the exchange had replenished 90 percent of the stolen assets by buying new tokens with company money and was committed to covering the remaining 10 percent, which sits in less liquid tokens that take longer to source. Binance has set aside about $6.34 billion of its own funds, drawing on its corporate treasury, part of its $1 billion Secure Asset Fund for Users and a slice of its futures insurance fund. Users, Teng repeated, will not bear the financial impact.

The exchange also took a fresh snapshot of platform assets at midnight GMT on Saturday for a new proof of reserves. Holders of BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC will be able to verify that their balances are backed at least one to one once the full proof is published.

When will Binance withdrawals reopen?

Sunday, if the plan holds. Binance said on Saturday it was on track to restart withdrawals on 1 November, roughly in line with the 40-hour target Teng set on Friday afternoon. The restart is expected to come in phases, network by network, rather than as a single switch, and the exchange has warned that processing may be slower than usual at first.

What happens in the hours after the gates open will say more about Binance's standing than any statement this week. Deposits never closed, so the first clean reading of customer confidence will be the net flow once withdrawals do. Crypto prices fell on Friday; Sunday will show whether the market believes the 90 percent, and the promised remainder, is enough.

Published in The Outspoken Digest

Editorial desk

Outspoken Digest Crypto Desk

Reports for The Outspoken Digest across Crypto.

Newsletter

The Digest, in your inbox

One edition, sent when it is ready. No noise, and your address is never passed on.

We send a confirmation first. One click to leave, always.

Share this story

the OUTSPOKEN digest

Beyond boundaries. Independent stories on technology, culture, and the trends shaping how we live.