The FBI said Saturday that North Korea was behind the theft of more than $6 billion in cryptocurrency from the crypto exchange Binance. In a cyber alert dated Oct. 31, the bureau tied the attack, on or about Oct. 29, to North Korean hacking activity it calls "TraderTraitor."
What the FBI says
The FBI, working with the Secret Service and IRS Criminal Investigation, says the hackers are converting the stolen assets mainly into Ethereum. The bureau expects the money to pass next through decentralized finance (DeFi) platforms and instant swap services, as one stage of a longer laundering process.
The alert lists 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address that hold or once held stolen funds and that the FBI links to the North Korean actors. The agencies want crypto businesses, from node operators and swap services to blockchain analytics firms, to refuse transactions involving those addresses or money that passed through them. Anyone with information can contact a local FBI field office or the FBI's Internet Crime Complaint Center at ic3.gov.
The FBI has blamed TraderTraitor for an exchange theft before: in February 2025, it attributed the roughly $1.5 billion theft from Bybit to the same North Korean activity.
What Binance says about customers' money
Binance says its hot wallets were compromised at about 20:05 UTC on Oct. 29, or 1:05 p.m. Pacific, and it puts the loss at about $6.3 billion. Its Oct. 30 update said about $3 billion had been frozen on-chain with the help of partners and that it had found no evidence that wallet private keys were leaked.
The exchange says customers will not bear the loss. In a recovery update posted Oct. 31, it said it had replenished 90% of the stolen assets using part of its Secure Asset Fund for Users, part of its futures insurance fund and its own treasury. Ten tokens, including bitcoin, ether, USDT, USDC, BNB, Solana and XRP, are fully backed. The remaining 10% consists of less liquid tokens that Binance says it is still buying.
Binance has given customers two dates:
- Withdrawals, suspended since the attack, are on track to reopen on Sunday, Nov. 1, according to Binance. Deposits have kept working.
- A new proof-of-reserves snapshot was taken at midnight UTC on Oct. 31. The full zero-knowledge proof that lets users check their balances are backed 1:1 is expected by Tuesday, Nov. 3 (UTC).
Binance says it will publish a technical account of the attack once its investigation is complete. Our earlier report covers what the hack meant for U.S. customers in its first hours.
