FBI Links $6 Billion Binance Hack To North Korean Hackers As Withdrawals Resume

US federal investigators confirmed on October 31 that the North Korean state-linked group was responsible for the October 29 attack, which resulted in approximately $6.3 billion being stolen from Binance's cryptocurrency wallets. The announcement followed earlier findings from blockchain intelligence companies Chainalysis and TRM Labs, which had also identified connections between the theft and North Korean cybercriminal activity.

Meanwhile, Binance has begun restoring withdrawal services after temporarily suspending transactions while investigating the breach. The exchange reported approximately $3.64 billion in net customer outflows during the first nine and a half hours after withdrawals resumed on November 1, highlighting the immediate financial impact of the incident and the pressure facing the platform as it works to restore customer confidence.

FBI Identifies TraderTraitor Group Behind Binance Attack

The FBI formally attributed the attack to TraderTraitor, a North Korean hacking operation previously linked to major cryptocurrency thefts. The group has also been tracked under several other names, including Jade Sleet and UNC4899, and is associated with sophisticated attempts to compromise cryptocurrency businesses and financial infrastructure.

Working alongside the US Secret Service and Internal Revenue Service Criminal Investigation, the FBI has been monitoring the movement of stolen assets across multiple blockchain networks. Investigators have observed the attackers converting substantial amounts of cryptocurrency into Ethereum, with further laundering expected through decentralised finance protocols and instant cryptocurrency exchange services.

Federal authorities have published hundreds of cryptocurrency wallet addresses associated with the operation, including 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address. Exchanges, blockchain infrastructure providers, decentralised finance platforms and analytics companies have been urged to block transactions involving the identified wallets to prevent the stolen assets from moving through the financial system.

The US Secret Service also confirmed that investigators had worked with cryptocurrency industry partners to identify and freeze a significant portion of the stolen funds shortly after the attack. The operation involves several federal agencies and US Department of Justice divisions, with efforts continuing to trace the remaining assets and prevent further laundering.

Hackers Move Hundreds Of Millions Through Blockchain Networks

Blockchain investigators have identified extensive attempts to distribute and conceal the stolen cryptocurrency since the breach. According to Chainalysis, the attackers transferred more than $500 million through the Tron network, using over 1,000 wallet addresses, thousands of deposits and several decentralised finance protocols to complicate efforts to trace the funds.

Much of the cryptocurrency was subsequently moved between blockchain networks through cross-chain services including Chainflip, Relay and THORChain. Investigators have observed assets reaching newly created wallets on Ethereum, Bitcoin and other networks, with further activity identified on Solana.

The movement of funds illustrates the difficulties authorities face when attempting to recover cryptocurrency stolen through large-scale cyberattacks. Although blockchain transactions are publicly recorded, criminals can distribute assets across numerous addresses and networks, making it more challenging to identify their ultimate destination.

Blockchain intelligence company Elliptic estimated that approximately $2.85 billion of the stolen cryptocurrency had been frozen or seized by November 1, representing around 44% of the total theft. Most of the restricted assets consisted of stablecoins whose issuers can prevent transfers from identified wallets, while other cryptocurrencies remain more difficult to immobilise once they have been moved beyond custodial platforms.

The investigation also identified similarities between the Binance attack and previous cryptocurrency thefts attributed to North Korean groups, including the February 2025 breach of Bybit. That incident resulted in approximately $1.5 billion being stolen, considerably less than the losses associated with the latest attack.

Binance Records $3.64 Billion In Net Withdrawals

Binance began gradually restoring cryptocurrency withdrawals at 06:00 UTC on November 1, following security assessments and efforts to replenish affected customer assets. All 15 networks and assets included in the first phase were available by 12:36 UTC, allowing customers to resume transfers involving major cryptocurrencies including Bitcoin, Ethereum, BNB and XRP.

During the first nine and a half hours after withdrawals resumed, Binance processed approximately $4.65 billion in withdrawals and $1.01 billion in deposits. This resulted in net outflows of around $3.64 billion, equivalent to 2.1% of the $171 billion in assets reported in the exchange's October 28 proof-of-reserves figures. Binance said withdrawal volumes had declined following an initial surge, while customer deposits remained substantial.

The exchange has subsequently expanded withdrawal services to additional blockchain networks and restored access to several fiat currencies, including US dollars, UAE dirhams, Vietnamese dong, Philippine pesos and Indonesian rupiah. However, the volume of cryptocurrency leaving the platform illustrates the scale of customer activity following the breach, with rival exchanges also recording substantial inflows during the disruption.

Binance took a new proof-of-reserves snapshot on October 31 and said it expected to publish the updated findings on November 2. The report is intended to provide further information about the assets supporting customer balances following the security incident.

Binance Commits To Covering Customer Losses

Binance has repeatedly stated that customers will not be required to absorb losses arising from the cyberattack. The exchange has committed to replacing affected assets through its corporate treasury, insurance arrangements and Secure Asset Fund for Users (SAFU), while continuing efforts to recover stolen cryptocurrency.

Chief Executive Richard Teng confirmed on November 1 that approximately 95% of the affected assets had been replenished, with the remaining balance largely consisting of less liquid cryptocurrencies that require additional time to purchase. "Binance will absorb the financial impact of the stolen funds, not our users," Teng said, reiterating the company's commitment to restoring customer balances.

The exchange has also worked with blockchain analytics companies, law enforcement agencies and stablecoin issuers to identify and restrict stolen funds. Circle has reportedly frozen more than $1.1 billion in USDC associated with the incident, while other cryptocurrency issuers have taken similar measures to prevent assets from being transferred.

The breach has also affected confidence across the wider cryptocurrency industry, with US spot Bitcoin exchange-traded funds recording approximately $643 million in net outflows on October 30. The incident has renewed concerns about exchange security, asset custody and the potential consequences of large-scale cryptocurrency thefts for both retail and institutional investors.

Binance has pledged to release a detailed investigation report once its security review is complete. Although withdrawal services are being restored and most affected customer assets have been replenished, the recovery of stolen cryptocurrency remains an active international investigation involving US authorities and blockchain intelligence specialists.