FBI pins the $6B+ Binance heist on North Korea's TraderTraitor as withdrawals resume
The FBI pinned the $6B+ Binance theft on North Korea's TraderTraitor. Withdrawals resumed Nov 1 in phases; ~95% is replenished and Binance absorbs the loss.
The largest crypto theft on record now has an official culprit. On October 31 the FBI, jointly with the Secret Service (USSS) and IRS Criminal Investigation (IRS-CI), published an alert attributing the theft of “more than $6 billion USD in virtual assets” from Binance “on or about October 29, 2026” to TraderTraitor, a North Korea-linked hacking group. A day later, on November 1 between 06:00 and 09:00 UTC, Binance began letting users withdraw funds again — in phases, asset by asset and network by network — and its same-day Recovery Update #4 put the replenished share of stolen assets at about 95%, with the exchange promising to absorb the entire loss itself.
Key points
- Two figures for one theft: the FBI’s official wording is “more than $6 billion”; TechCrunch, The Guardian and others put it at about $6.3 billion and call it the biggest crypto heist in history.
- Binance’s Recovery Update #4 (November 1): the first withdrawal phase opened 06:00–09:00 UTC; balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are 100% backed and verifiable in its proof-of-reserves snapshot; coverage rose from 90% to about 95%.
- The FBI has watched the thieves convert the loot primarily into ETH, expects further laundering through DeFi and instant-swap services, and has published hundreds of Ethereum addresses plus a set of Bitcoin addresses for services to block.
Background
The heist itself played out on October 29. Per Digital Trends, the funds moved out in roughly 20 minutes, and Binance suspended deposits and withdrawals across several networks while it contained the damage; TechCrunch first reported the breach on October 30. The replenishment numbers have moved in steps — 80%, then 90%, and now about 95% in update #4. The Guardian’s Sunday-evening piece still cites 90%: a timing artifact, not a contradiction, since each number marks the same commitment at a different hour. Attribution points to TraderTraitor, considered part of the Lazarus Group — the outfit behind the 2014 Sony Pictures hack, as The Guardian recalls — and experts have labeled this case the biggest heist in history. It also lands in a stretch of platform-compromise disclosures: last month PingCAP confirmed an unauthorized intrusion that copied source code, and in the Cairn agent-panel abuse researchers located more than 20 suspected malicious panels.
The facts
The hard numbers, by source. From Binance via TechCrunch: between 06:00 and 15:30 UTC on November 1 the exchange processed $4.6 billion in withdrawals against $1.0 billion in deposits — a net outflow of $3.6 billion, about 2.1% of assets under management. DefiLlama separately logged more than $3.5 billion in net outflows on Sunday (per Digital Trends, citing Reuters). On prices, The Guardian reports BTC fell nearly 5%, ETH nearly 6% and BNB nearly 10% after the news. The replenishment is funded from SAFU (the $1 billion secure-asset fund), the futures insurance fund and corporate treasury — about $6.34 billion of company money by The Guardian’s count. The last 5% sits in tokens outside the top ten, which Binance says are “less liquid in the market and take longer time to source at the required scale”; it is buying them through market and OTC channels. The FBI alert lists hundreds of Ethereum addresses and a batch of Bitcoin addresses, and urges THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other VASPs to block transactions with or derived from them.
| Time (2026, UTC) | Event |
|---|---|
| Oct 29 | Funds moved out in ~20 minutes; Binance suspends deposits and withdrawals (per Digital Trends) |
| Oct 30 | TechCrunch first reports the breach |
| Oct 31 | FBI publishes attribution alert with USSS and IRS-CI |
| Nov 1, 06:00–09:00 | First withdrawal phase reopens, asset by asset |
| Nov 1, during the day | Recovery Update #4: coverage up from 90% to ~95% |
What others say
The FBI brought the Secret Service and IRS-CI into one alert, yet The Verge notes the alert “offered few other details or evidence.” Binance’s co-CEO called it a “complex attack” involving “a compromised laptop and malicious software designed to delete evidence of its activity,” which makes the investigation harder (The Guardian). President Trump, for his part, said on Saturday that North Korea’s involvement wasn’t certain (Digital Trends) — flatly at odds with the joint FBI attribution. Digital Trends closes on the open question: with billions already withdrawn, how quickly can Binance regain its users’ confidence?
Our take
For ordinary users, the load-bearing promise is who pays: stolen funds are being replaced from SAFU, the insurance fund and Binance’s own money, not from user balances, and holders of the ten major assets can check the proof-of-reserves page themselves. For teams building on-chain risk tooling or anything adjacent to exchanges, the FBI’s address list is a ready-made blacklist input for your screening pipeline. The honest caveats: the FBI released no evidence; the attack vector — that compromised laptop — is so far Binance’s account alone; there is no timetable for the remaining 5%; and the White House and the FBI now disagree in public about attribution, which means this case is not politically settled.
What to watch
Binance has committed to publishing a post-incident report once its investigation closes — the document that should settle the attack vector and the full loss picture. The remaining 5% keeps arriving through market and OTC purchases. And with the loot headed toward DeFi and instant swaps, expect the FBI’s address list to keep growing; its follow-up updates are worth tracking.