FBI Links $6.3B Binance Theft to North Korea as Withdrawals Resume

Binance says hackers stole about $6.3 billion in crypto from its hot wallets on Oct. 29, a theft the FBI has attributed to North Korea’s TraderTraitor group. The exchange, long accused of enabling crypto crime, has begun reopening withdrawals in phases, according to its latest security incident update.

The attack has turned a major crypto exchange into a target, and customers are now relying on Binance’s recovery process to restore access to funds.

What does the FBI say happened?

The FBI says North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or about Oct. 29. It refers to the activity as TraderTraitor and says the stolen assets are being converted primarily into ether.

Binance said the incident involved unauthorized withdrawals from compromised hot wallets, which hold crypto for operational use. Its investigation is ongoing; the exchange said it had found additional points of breach after initially suspecting a compromised laptop, but had no evidence that wallet private keys were leaked.

The FBI is asking exchanges, blockchain operators and other crypto services to block transactions linked to addresses used in laundering the stolen assets. Its public alert includes a list of addresses associated with the theft.

Which withdrawals are available now?

Binance says withdrawals are returning in stages after a temporary suspension for security checks. The first phase covers major assets including BTC, ETH, USDT, USDC, BNB, SOL and XRP across selected networks, with other assets to follow as checks are completed.

The exchange says it is prioritising networks and assets based on user demand over the previous week. It warns that processing may be slower during the rollout, and advises customers to check availability for the specific asset and network before initiating a withdrawal.

How much of the loss has Binance covered?

Binance reported that it had replenished about 95% of the affected amount by its Nov. 1 update. It said the remaining 5% consists of less-liquid tokens it is still sourcing through market and over-the-counter purchases.

The exchange says it will absorb the financial impact rather than pass the loss to users. Its replenishment draws on the Secure Asset Fund for Users, a portion of its futures insurance fund and corporate funds; Binance says the futures fund remains above its required level.

Binance reported that major balances including BTC, ETH, USDT, BNB and USDC were fully backed, and that it had published a proof-of-reserves snapshot. It has also said roughly $3 billion in affected assets were frozen on-chain, while its investigation and recovery work continue.

Sources

• latest security incident update — binance.com
• public alert — fbi.gov