FBI attributes $6.3 billion Binance theft to North Korea as exchange rebuilds reserves
The FBI blamed North Korea for the record crypto theft as Binance said it had replaced 90% of the stolen assets but had not yet confirmed withdrawals had resumed.
Focal Brief
The FBI on October 31 attributed the theft of more than $6 billion from Binance to North Korea’s TraderTraitor operation, as the exchange worked to restore reserves and withdrawal access following unauthorized transfers on October 29.
Focal Facts
- Binance dated the unauthorized hot-wallet withdrawals to about 20:05 UTC on October 29.
- The exchange estimated losses at $6.3 billion and said roughly $3 billion had been frozen on-chain.
- On October 31, Binance said 90% of affected assets had been replenished and the 10 largest affected tokens were fully backed.
Focal Point
The decisive operational signal is the actual restoration of customer withdrawals, which Binance scheduled for November 1 but had not confirmed as completed in its latest published update.
Binance said attackers compromised its hot wallets and removed about $6.3 billion in tokens. Its initial investigation pointed to a compromised DevOps engineer’s laptop, but a later update said investigators had found additional breach points. The company said it had found no evidence that wallet private keys were leaked.
The FBI said TraderTraitor actors were converting stolen assets primarily into ether and urged exchanges, decentralized-finance services and blockchain infrastructure operators to block transactions connected to listed addresses.
Binance has pledged to absorb the losses through its corporate treasury, futures insurance fund and Secure Asset Fund for Users. By October 31, it said it had replenished 90% of affected assets and completed a new proof-of-reserves snapshot. A full zero-knowledge proof was expected by November 3.
The next consequential question is whether Binance can restore withdrawals after its security checks without uncovering further breach points or reserve gaps.