FBI Attributes $6 Billion Binance Hack to North Korea; Exchange Manages Withdrawals Amid Outflows

The Federal Bureau of Investigation (FBI) has officially attributed a cryptocurrency theft exceeding $6 billion from the exchange Binance to North Korean state-sponsored hackers, identified by the FBI as ‘TraderTraitor.’ This attribution was reported by blockchain analytics firms TRM Labs and Chainalysis. The incident occurred on or around October 29, 2026, and has prompted significant operational responses from Binance, including the phased restoration of customer withdrawals.

Law Enforcement Pursues Stolen Assets

Law enforcement agencies, including the FBI, the Secret Service, and IRS Criminal Investigation, are actively working to trace and recover the stolen assets. According to the FBI, hackers have been converting the stolen virtual assets primarily into Ethereum and are expected to launder the funds further through decentralized finance (DeFi) and instant swap services. The Secret Service indicated that a significant portion of the stolen cryptocurrency was frozen within minutes of the attack, a process that involved collaboration with industry partners.

Following the attack, hackers moved over $500 million on the Tron network through more than 1,000 addresses and several Tron-based DeFi protocols, Chainalysis reported. Funds have since been observed moving from Tron through cross-chain services to various wallets on Ethereum, Bitcoin, and other blockchains, with launderers reportedly beginning to move assets onto Solana. Law enforcement has urged crypto businesses to block transactions involving hundreds of Ethereum addresses, 19 Bitcoin addresses, and one Solana address linked to the theft.

Binance Manages Withdrawals and Financial Impact

Binance began restoring withdrawals in phases on Sunday, November 1, 2026. In the first nine and a half hours of restored withdrawals, the exchange processed approximately $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of about $3.64 billion. This outflow represented 2.1% of Binance’s reported assets of $171 billion as of October 28, 2026. Binance stated that withdrawal volumes have since declined and are stabilizing.

Binance CEO Richard Teng announced that the exchange has replenished approximately 95% of the affected assets and will absorb the financial impact of the stolen funds, assuring users that they would not bear the cost. The exchange has also restored fiat withdrawals in several currencies, including USD, UAE dirhams, Vietnamese dong, Philippine pesos, and Indonesian rupiah. Binance reported raising $6 billion from its corporate treasury, an insurance fund, and its SAFU emergency fund to cover the losses. Circle reportedly froze over $1.1 billion in USDC related to the incident.

Data from DefiLlama indicated that Binance’s total assets were approximately $127.6 billion on Monday. Over the 24 hours following the reopening of withdrawals, more than $6 billion left wallets associated with Binance, though these movements can include transfers between the exchange’s own wallets. Rival exchanges OKX and Bybit saw net inflows of approximately $450 million and $134 million, respectively, during this period.

Broader Market Repercussions

The hack has also had a broader impact on the cryptocurrency market. Spot Bitcoin ETFs experienced outflows totaling $643.2 million on Friday, the first full trading session after the hack, contributing to roughly $516 million in net outflows for October. TRM Labs’ Ari Redbord commented to Reuters that “A hack at a crypto exchange is bank robbery at the speed of the internet.”

Uncertainties remain regarding the exact total amount of funds still unfrozen or unrecovered, the precise methods and final destinations of all laundered funds, and the long-term impact on Binance’s reputation and user trust. It is not reported whether all affected users will be fully compensated, nor have the hackers been apprehended or officially sanctioned by authorities.

Why This Matters

The FBI’s confirmation of North Korean state-sponsored hacking activity targeting Binance, with over $6 billion in virtual assets stolen, underscores the persistent threat of sophisticated cybercrime in the digital asset space. While Binance has taken steps to manage the fallout and absorb losses, the incident highlights ongoing challenges in fund recovery and the need for enhanced industry-wide security measures.

Broader Context

This event places the factual news in the context of the ongoing challenges in tracking and recovering stolen funds, and the broader implications for cybersecurity in the crypto space. The FBI’s attribution of the hack to North Korea, coupled with Binance’s operational and financial response, illustrates the complex interplay between state-sponsored cyber threats, major cryptocurrency exchanges, and law enforcement efforts.