Binance hack: FBI blames North Korea for $6bn theft

About $6.3 billion in virtual assets left Binance, the world's largest cryptocurrency exchange, on or about 29 October 2026. Blockchain firms TRM Labs, Chainalysis and Elliptic estimated the total at $6.36 billion to $6.43 billion across ten or eleven blockchains, and said the bulk of the movement unfolded in around 20 minutes.

Binance put the theft at about $6.3 billion. The gap between the figures is small in percentage terms but large in cash terms: the top of the blockchain firms' range sits about $130 million above Binance's figure. The FBI, for its part, described the theft as more than $6 billion in virtual assets.

FBI points to North Korea

On Saturday 31 October 2026, the FBI said North Korea was responsible for the theft. The FBI named the activity "TraderTraitor" and described it as a North Korean state-sponsored unit. It is the same group the FBI blamed for the theft of about $1.5 billion from Bybit in February 2025.

The FBI said it observed TraderTraitor converting stolen assets primarily into Ethereum (ETH). It said it expects further laundering through decentralised finance services, known as DeFi, and instant swap services. The FBI published attacker wallet addresses and asked crypto firms to block transactions linked to them. It said it worked with the US Secret Service and IRS Criminal Investigation on the case.

Binance says 95 percent replenished

On Saturday, Binance said it had replenished 90 percent of the stolen assets. It said it used company funds, its SAFU emergency fund and its futures insurance fund to do so. Binance said 50 percent of SAFU would be used, and that SAFU would then be replenished to about $1 billion. It said it had set aside about $6.34 billion of company money, and that customers would not bear the loss.

By Sunday, the reported coverage figure had risen to 95 percent. The remaining 5 percent was reported to be in less liquid assets that are taking longer to source. Binance's replenishment claim has not been independently audited, so the 95 percent figure rests on the company's own account for now.

Withdrawals resume in phases

Binance resumed withdrawals in phases on Sunday 1 November 2026, starting shortly after 0600 GMT with bitcoin. Ether, BNB, XRP, dogecoin, Solana and some USDT and USDC stablecoins followed in the first phase, which covered 15 cryptoassets in total, prioritised by user demand. Binance warned of possible congestion and temporary delays as withdrawals reopened.

Bitcoin traded near $77,700 to $77,865 on 1 November. BNB rose about 1 percent on Sunday.

Timeline

1. 29 October 2026: theft of about $6.3 billion from Binance, with the bulk moving in around 20 minutes.
2. 31 October 2026: the FBI attributes the theft to North Korea's TraderTraitor unit, and Binance says 90 percent of assets have been replenished.
3. 1 November 2026: Binance resumes withdrawals in phases from shortly after 0600 GMT, and reported coverage reaches 95 percent.

What changed

The scale sets this theft apart. At about $6.3 billion, it is roughly four times the $1.5 billion Bybit theft of February 2025. The comparison is not only about the headline number: the Bybit case already involved the same attributed group, so the Binance theft suggests a repeat playbook at far larger scale rather than a one-off breach.

The recovery picture also changed within a day. Replenishment moved from 90 percent on Saturday to a reported 95 percent on Sunday, while the exchange moved to a phased reopening of withdrawals. The remaining gap is now concentrated in less liquid assets, which explains why the last portion is slower to source than the first 90 percent was.

Who is affected and what to do

Binance users are the most directly affected group. Users waiting to withdraw should check which phase their asset falls into, starting with the 15 cryptoassets in phase one, and should expect congestion and temporary delays.

Crypto firms face a different task. The FBI has asked them to block transactions linked to the published attacker wallet addresses. Firms that act on that list can slow the laundering route the FBI expects, through DeFi and instant swap services.

Where the accounts disagree

The attribution is the sharpest disagreement. The FBI said on Saturday that North Korea was responsible. US President Donald Trump said on Saturday that the US was still not certain North Korea was involved. Both statements are reported here without resolving the conflict.

The size estimates also differ. The FBI said more than $6 billion, Binance said about $6.3 billion, and blockchain firms estimated $6.36 billion to $6.43 billion. The figures point in the same direction, but they are not identical, and the range should be kept in view when the theft is described. The replenishment claim carries a further caveat: it has not been independently audited.

What happens next

From 1 November onward, three tracks will run in parallel. Binance will continue its phased withdrawal reopening, with users watching for congestion and delays as more assets are added. Crypto firms will decide whether to block the wallet addresses the FBI published, a step that could affect how quickly stolen assets can move through DeFi and instant swap services. And the remaining 5 percent of less liquid assets will need to be sourced, a portion that is taking longer to source than the first portion. Whether the FBI's attribution gains further support, and whether the replenishment figure is independently verified, are the two questions that will determine how this case is remembered.

📷 Photo credit: Satheesh Sankaran, Wikimedia Commons (CC BY 2.0)