The FBI has formally attributed the $6.3 billion hack of Binance to TraderTraitor, a North Korea-linked hacking operation, identifying hundreds of cryptocurrency addresses tied to the theft and urging exchanges, decentralized finance (DeFi) protocols and blockchain infrastructure providers to block transactions involving the stolen funds. The determination was set out in an alert published October 31, two days after attackers compromised the exchange's hot wallets and moved billions of dollars across multiple blockchains.

Approximately $3 billion in affected assets has since been frozen through coordination with stablecoin issuers and blockchain partners. Binance, meanwhile, has restored roughly 95% of the impacted assets using corporate reserves and emergency funds as it prepares to restart customer withdrawals on November 1.

Federal Agencies Trace Laundering of Stolen Funds

In its announcement, the FBI attributed the October 29 theft to TraderTraitor, an operation previously linked to major cryptocurrency heists. The cluster was first named in U.S. government advisories in 2022, when federal agencies connected it to the roughly $620 million theft from the Ronin bridge, at the time the largest exploit in the industry. Working with the U.S. Secret Service and IRS Criminal Investigation, federal investigators determined that the stolen assets are being converted primarily into Ethereum, with further laundering expected through decentralized exchanges, instant-swap services and other DeFi infrastructure. In previous TraderTraitor-linked cases, laundering chains ran through mixing services, a pattern that led the U.S. Treasury to sanction mixers including Blender.io and Tornado Cash in 2022.

The agencies called on trading platforms, THORNode operators, RPC providers and blockchain analytics companies to block transactions involving identified attacker-controlled addresses. The FBI also published an extensive list of cryptocurrency addresses associated with the operation, including hundreds on Ethereum and additional addresses on Bitcoin and Solana. Publishing address lists in this way gives exchanges and analytics firms a common screening reference, turning centralized on-ramps and issuer freeze functions into practical points of interdiction.

The attribution reinforces earlier findings by blockchain intelligence firms TRM Labs and Chainalysis, which identified transaction patterns consistent with North Korean operations. U.S. officials and United Nations sanctions monitors have previously assessed that cryptocurrency theft serves as a significant revenue source for North Korea's weapons programs. TraderTraitor was also implicated in the February 2025 attack on Bybit, which produced losses of approximately $1.5 billion. The Binance breach is more than four times larger, making it the largest cryptocurrency theft on record based on current estimates.

President Donald Trump responded cautiously when asked about the North Korean connection on October 31, saying his administration was still assessing the situation. “We don’t know if it’s North Korea, but if it is, we’ll talk to North Korea about it,” Trump said during remarks at Mar-a-Lago.

Binance Restores 95% of Assets Ahead of Withdrawal Restart

Binance has moved quickly to rebuild affected reserves, raising replacement coverage from 80% on October 30 to 90% the following day and approximately 95% by November 1. The exchange confirmed that ten major assets are now fully backed: BTC, ETH, USDT, USDC, BNB, SOL, XRP, USD1, RLUSD and ZEC. The remaining 5% consists primarily of less liquid tokens, which Binance continues to acquire through market purchases and over-the-counter transactions.

The replenishment draws on Binance's Secure Asset Fund for Users (SAFU), its futures insurance fund and its corporate treasury. SAFU was established in 2018 as an emergency reserve to protect customer funds during exchange shortfalls. Replacing reserves is distinct from recovering the stolen cryptocurrency, however: the roughly $3 billion frozen on-chain has not necessarily been returned to the exchange.

Withdrawals are scheduled to resume progressively between 06:00 and 09:00 UTC on November 1, beginning with major networks including Bitcoin, Ethereum, BNB Chain, Solana, Tron and XRP Ledger, according to a company announcement. Deposits have remained operational throughout the recovery process.

Binance's initial investigation identified a potentially compromised DevOps employee's laptop and unauthorized access to internal withdrawal infrastructure, although subsequent findings revealed additional points of compromise. The exchange said it has found no evidence that wallet private keys were leaked. A complete technical explanation remains pending.

With the FBI's attribution now formalized, attention shifts toward tracing and disrupting the movement of the stolen funds. Developments worth watching include whether withdrawals resume on schedule on November 1, whether any of the roughly $3 billion in frozen assets is recovered through legal channels, and the technical post-mortem Binance has yet to publish. The scale of the attack, despite Binance's commitment to absorb customer losses, underscores the continuing threat that state-sponsored hacking operations pose to cryptocurrency infrastructure.