FBI blames North Korea for $6.3 billion Binance hack

Developing: The FBI says North Korea's TraderTraitor group stole about $6.3 billion from Binance. The exchange says it has covered 95% and is reopening withdrawals.

What happened at Binance

Hackers stole about $6.3 billion in cryptocurrency from the exchange Binance beginning late on Oct. 29, 2026, and the bulk of the theft unfolded in around 20 minutes, Reuters reported on Oct. 30. The FBI said the next day that North Korea was behind it, according to CBS News.^[1][2]

Binance co-CEO Richard Teng called it a "complex attack" that included a compromised laptop and malicious software designed to delete evidence of its activity, Reuters reported. Abu Dhabi's Financial Services Regulatory Authority said it was monitoring the incident, Reuters reported.^[1]

Reports differ on the amount. Reuters and TechCrunch put the loss at $6.3 billion, The Hacker News cited $6.43 billion, and the FBI said "more than $6 billion" in the statement CBS News quoted. Binance reported 335 million registered users and about $162.8 billion in assets under custody in its 2025 annual report, Reuters said.^[1][3][4][2]

What the FBI said about North Korea

In a statement on Saturday, Oct. 31, the FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance "on or about October 29, 2026," CBS News reported. The Hacker News said the FBI acted with the U.S. Secret Service and IRS Criminal Investigation and named the group as TraderTraitor, which security researchers also track as Jade Sleet and UNC4899.^[2][4]

CBS News reported that TraderTraitor is the group blamed for the roughly $1.5 billion theft from the Bybit exchange in February 2025. Measured against that figure, the Binance loss of about $6.3 billion is about 4.2 times larger (6.3 divided by 1.5, using the Reuters and CBS News amounts).^[2][1]

The FBI expects the stolen assets to be laundered through decentralized finance and instant swap services, CBS News reported. Unchained reported that the bureau's wallet list contains 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address, which adds up to 628, and that the Secret Service said it worked with industry partners to freeze "a significant portion of stolen cryptocurrency."^[2][5]

North Korea denied involvement. Kim Yo Jong, sister of leader Kim Jong Un, called the FBI finding a "grave political provocation" in a statement carried by the Korean Central News Agency and reported by Yonhap on Nov. 3, according to crypto.news.^[7]

How much has been frozen and repaid

Binance said on Oct. 30 that it had set aside about $6.34 billion of company funds to cover the losses and had located about $3 billion of the stolen assets, Reuters reported. Tether said it froze nearly $1.57 billion and Circle froze more than $800 million, Reuters reported.^[1]

The Hacker News reported on Nov. 1 that $2.85 billion of the $6.43 billion it counted as stolen had been frozen on-chain by Tether, Circle, Ripple, Arbitrum and Optimism. The two frozen-asset figures come from different sources and dates and have not been reconciled.^[4]

TechCrunch reported on Nov. 1 that Binance said it had covered 95% of the stolen assets, and quoted the exchange as saying "These losses will not be passed on to users." CBS News had reported that Binance said it would cover 90% of the losses. The Block reported on Nov. 2 that the remaining 5% sits in less-liquid tokens Binance is still working to acquire, and quoted Teng saying "There's still work to do."^[3][2][6]

Withdrawals and customer outflows

Binance began restoring withdrawals in phases at 6 a.m. UTC on Nov. 1, The Hacker News reported. CBS News listed Bitcoin, BNB, XRP and Dogecoin among the first assets reopened.^[4][2]

Between 06:00 and 15:30 UTC on Nov. 1, Binance processed $4.649 billion in withdrawals and $1.01 billion in deposits, according to company figures cited by The Hacker News. That is a net outflow of about $3.64 billion ($4.649 billion minus $1.01 billion). The Block reported on Nov. 2, citing DefiLlama, that 24-hour net outflows had fallen to about $3.29 billion from a peak near $7 billion.^[4][6]

Bitcoin fell to a six-week low of $76,368 and Binance's BNB token dropped 6.74% over 24 hours to $698, Reuters reported on Oct. 30.^[1]

What happens next

Binance said it completed a zero-knowledge proof of reserves for 10 tokens, including BTC, ETH, USDT and BNB, which it described as backed one to one, The Block reported. The exchange plans another reserves snapshot on Wednesday, Nov. 4, and co-CEO Yi He said generating the proof takes about 40 to 50 hours after a snapshot is completed, The Block reported.^[6]

Binance has said it will publish a more detailed incident report when its investigation ends, TechCrunch reported. The final amount stolen, how much can be recovered and the progress of the laundering the FBI expects are not yet known.^[3]