The FBI has confirmed that North Korean hackers were behind the theft of more than $6 billion in virtual assets from Binance, publishing hundreds of blockchain addresses linked to the attack as the exchange began reopening withdrawals and reported billions of dollars leaving the platform.

In an alert published on Saturday, the bureau said the operation was carried out by the North Korean hacking group it refers to as "TraderTraitor," confirming the attribution that blockchain analytics firms TRM Labs and Chainalysis had made on Friday. The FBI said the funds were stolen from the cryptocurrency exchange on or about October 29, 2026, and posted the notice to its official cyber alert page.

TraderTraitor is the designation U.S. authorities use for Democratic People's Republic of Korea (DPRK)-linked actors behind high-value cryptocurrency thefts. The agency announced its finding on X:

The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North… pic.twitter.com/TBUvUFln4n

— FBI Cyber Branch (@FBICyberBranch) October 31, 2026

View the FBI Cyber Branch's post on X

Working together with the U.S. Secret Service and IRS Criminal Investigation, the FBI said it has observed the hackers converting the stolen assets mainly into Ethereum and expects them to launder the funds further through decentralized finance (DeFi) and instant swap services. The bureau urged node operators, instant exchanges, DeFi services, blockchain analytics firms, and other crypto businesses to block transactions involving the hundreds of Ethereum addresses, 19 Bitcoin addresses, and one Solana address it linked to the theft.

The Secret Service, which is also investigating the theft, said on Sunday that its investigators worked with industry partners to identify and freeze "a significant portion" of the stolen crypto within minutes of the attack. That work continues alongside the FBI, IRS Criminal Investigation, the U.S. Attorney's Offices for Washington, D.C. and the Central District of California, and the Justice Department's computer crime and national security divisions, the agency said.

The laundering is already well underway. Blockchain analytics firm Chainalysis said on Sunday that after the attack, the hackers moved more than $500 million on Tron through more than 1,000 addresses, over 3,000 deposits, and several Tron-based DeFi protocols. Most of those staging wallets have now been drained, with funds leaving Tron through cross-chain services including Chainflip, Relay, THORChain, and NEAR into dozens of fresh wallets on Ethereum, Bitcoin, and other chains, and the launderers have started moving onto Solana, the firm said. That activity is consistent with the FBI's expectation that the stolen funds would be laundered further through DeFi and instant swap services.

Withdrawals Resume

Binance began restoring withdrawals in phases at 1 a.m. ET on Sunday, and all 15 networks and assets in its first phase were available by 7:36 a.m. ET. In the first nine and a half hours, the exchange processed $4.649 billion in withdrawals and $1.01 billion in deposits, a net outflow of about $3.64 billion, according to Binance.

The company said that net outflow represented 2.1% of the $171 billion in assets reported in its most recent proof of reserves, dated October 28. "After an initial spike, withdrawal volumes have declined and are stabilising as expected," Binance said. It took a new reserves snapshot on October 31 and expects to publish an updated report on Monday. Because the October 28 snapshot predates the theft, Monday's report will be the exchange's first published proof of reserves taken after the attack.

As withdrawals began, CEO Richard Teng said Binance had replenished approximately 95% of the affected assets, describing a careful, phased approach designed to bring services back safely and securely. "Binance will absorb the financial impact of the stolen funds, not our users," he wrote.

Today, we're beginning the phased resumption of withdrawals, taking a careful approach to ensure services return safely and securely. We've now replenished approximately 95% of the impacted assets, and our commitment remains clear: Binance will absorb the financial impact of the… pic.twitter.com/uWFGs3sJJ5

— Richard Teng (@_RichardTeng) November 1, 2026

View Richard Teng's post on X

Binance has since reopened withdrawals on more networks, including Zcash, TON, and Sui, and on Monday restored fiat withdrawals in U.S. dollars, UAE dirhams, Vietnamese dong, Philippine pesos, and Indonesian rupiah.

"Our top priority right now is to ensure the environment is secure, after which users can withdraw their funds and Binance can resume operations," Binance co-CEO Yi He said on X on Monday, as reported by Reuters.

The exchange said it has raised $6 billion to cover the losses, drawing on its corporate treasury, an insurance fund, and its SAFU emergency fund, according to Reuters, which also reported that stablecoin issuer Circle had frozen more than $1.1 billion in USDC.

Data from DefiLlama, which tracks the public wallets of exchanges, put Binance's total assets at about $127.6 billion on Monday. More than $6 billion left wallets associated with Binance over the 24 hours after withdrawals reopened, CoinDesk reported, citing DefiLlama, though those movements can include transfers between Binance's own wallets. Rival exchanges OKX and Bybit recorded net inflows of about $450 million and $134 million, respectively, during Binance's reopening.

The hack has also rattled institutional investors. Spot Bitcoin ETFs shed $643.2 million on Friday, the first full trading session after the attack, leaving the funds with roughly $516 million in net outflows for October.

"A hack at a crypto exchange is bank robbery at the speed of the internet," TRM Labs' Ari Redbord told Reuters.

This article is based on Decrypt's original reporting.