North Korea blamed for $6bn Binance theft as exchange restarts withdrawals

Binance has resumed withdrawal services on Sunday following a security incident that saw the platform compensate approximately 95% of the losses using internal funds. Simultaneously, the FBI is urging cryptocurrency platforms to freeze accounts associated with the suspected perpetrators from North Korea.

Federal investigators have attributed the breach at Binance, the world's largest cryptocurrency exchange, to North Korean state actors. According to the FBI's Saturday announcement, more than $6bn in digital assets were stolen on or around 29 October. The agency designated the operation as "TraderTraitor."

The FBI is collaborating with the US Secret Service and the IRS Criminal Investigation division. Their joint analysis indicates that TraderTraitor operatives have been converting stolen holdings predominantly into ether (ETH), the native token of the Ethereum blockchain.

It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages

FBI statement

The three agencies are requesting that cryptocurrency infrastructure providers take action to prevent movement of the stolen funds. Their appeal extends to THORNode operators, RPC node operators, instant exchanges, DeFi protocols and blockchain analytics companies. The FBI has published hundreds of Ethereum addresses, 19 Bitcoin addresses and a single Solana address connected to the theft.

https://x.com/FBICyberBranch/status/2116660730745299426?ref_src=twsrc%5Etfw

TraderTraitor's history of major breaches

The same group has been previously linked by the FBI to a $1.5bn theft from the Bybit exchange in February 2025. Blockchain analysis firms TRM Labs and Chainalysis had already connected the Binance incident to this actor before the FBI's official attribution on Thursday.

Elliptic, a blockchain intelligence platform, calculated the stolen amount at $6.43bn, while Binance's internal assessment places it at approximately $6.3bn. The firm noted that this single theft represents a dramatic increase in the regime's cryptocurrency theft portfolio.

This single incident almost doubles the total cryptoassets stolen by the regime

Elliptic

According to Elliptic's research, North Korean-linked actors have accumulated over $6.5bn in stolen cryptocurrency in recent years, including more than $1bn tracked during 2026 prior to the Binance hack. In September, Bitget reported a $351.6m theft from its hot wallets attributed to suspected North Korean hackers. Additionally, the US indicted 14 individuals this month for placing North Korean IT personnel within over 70 companies, and North Korean cybercriminals are reportedly developing their own artificial intelligence capabilities.

President Donald Trump referenced a potential North Korean connection a day before the FBI's formal statement. Kevin Whitelaw documented Trump's remarks for Bloomberg.

I've always felt it was a little bit dangerous

President Donald Trump

North Korea has consistently denied responsibility for cyberattacks in previous incidents, as reported by Osmond Chia and Angus Thompson for the BBC.

Service restoration underway

Binance initiated a phased withdrawal restart on Sunday, commencing between 06:00 and 09:00 UTC according to the platform's recovery announcement. The initial phase prioritizes networks and assets that experienced the highest user activity during the preceding week, with additional phases rolling out as security protocols are completed. The exchange maintained that deposit functionality remained operational throughout the incident.

The platform has now replenished 95% of the lost funds, an increase from 90% reported on Saturday. Binance is acquiring the remaining 5% through both market purchases and over-the-counter transactions. These final holdings consist of less liquid tokens outside the platform's ten most-traded assets, requiring extended procurement timelines due to liquidity constraints, according to Binance.

The exchange mobilized over $6.34bn from company resources to address the shortfall. Funding sources included its Secure Asset Fund for Users (SAFU), designated as an emergency reserve, supplemented by withdrawals from its derivatives insurance fund and general corporate treasury. Binance has committed to restoring SAFU to approximately $1bn.

Binance will absorb the financial impact of the stolen funds, not our users

Binance

Binance acknowledged the FBI's cybersecurity division for its cooperation in an X platform post.

https://x.com/binance/status/2116758629634478111?ref_src=twsrc%5Etfw

The exchange intends to release a comprehensive zero-knowledge proof of reserves by Tuesday, 3 November. This cryptographic verification will enable holders of Binance's ten primary tokens to independently confirm that the platform maintains at least one unit of each token for every unit held by users.

Source: The Next Web