FBI blames North Korea for record Binance theft of about $6.3bn

The short version: someone drained about $6.3 billion from Binance, the world’s largest crypto exchange. The FBI says North Korea’s TraderTraitor unit did it. Binance says users won’t pay for it, and withdrawals are coming back in stages. We still don’t know how the attackers got in.

What’s confirmed

On the evening of 29 October, TRM Labs says, an attacker began moving about $6.36 billion out of Binance wallets across ten blockchains. Most of it left in about 20 minutes. Binance’s own estimate is around $6.3 billion. The Hacker News, reporting on the FBI’s statement, puts the figure at $6.43 billion. The totals differ because each party counts differently, and the numbers may still move.

On Saturday 31 October, the FBI named TraderTraitor, a North Korean state-sponsored unit. That is a government attribution, which is the bar we need. Before it, TRM and Elliptic had both pointed at the same group.

For scale, this is about four times the Bybit theft of February 2025, also blamed on TraderTraitor. Before Bybit, the biggest thefts were Poly Network’s $611 million in 2021 and an earlier $570 million Binance loss in 2022.

How it happened (so far)

Binance’s initial investigation suggests the incident may involve a compromised DevOps engineer’s laptop. That laptop reportedly gave the attacker access to a service container, from which they submitted unauthorised withdrawals. Binance says it has found no evidence that any wallet private key leaked. Note the hedging: this is the company’s early view, not a final finding.

TRM’s reading is that the evidence points to a compromise of Binance’s hot wallet signing infrastructure. Elliptic reports that a single transaction carried 50 authorisations, all validly signed with the key of a Binance hot wallet. It says this closely resembles Bybit, where North Korean hackers compromised a developer’s machine at a wallet provider and manipulated what signers approved.

Our analysis, not a finding: a valid signature doesn’t prove a key was stolen. An attacker who controls the system that requests signatures can get legitimate ones. That would fit Binance’s “no key leak” statement and the signing-infrastructure theory at the same time. But nobody has published enough to say.

TraderTraitor has a history of tricking victims into installing malware-laced applications. How this particular laptop was compromised has not been disclosed. TechCrunch notes that Binance did not answer questions about whether a third-party security audit had been done. Researchers told NPR it is too early to say whether Binance’s security had major flaws. We won’t guess either.

Money, frozen and replaced

Binance’s spokesperson said about $3 billion has been frozen by industry partners. The Hacker News, citing the FBI, says $2.85 billion was frozen on-chain by Tether, Circle, Ripple, Arbitrum and Optimism. Those are close, and neither figure is final.

Binance says it set aside about $6.34 billion of company funds to cover losses and had replaced 90% of the stolen assets by Saturday. By Sunday it said 95% was covered. The rest are less liquid tokens that take longer to buy. Binance has also promised an updated Proof of Reserves once remediation is complete. That is a claim until the audit appears.

Withdrawals began reopening on Sunday 1 November, Bitcoin first, then Ethereum and BNB Smart Chain. The network status page still showed a patchwork of normal, partial and suspended. Bloomberg, citing DefiLlama data, reported about $3.5 billion in net outflows by Sunday evening in Asia. Co-CEO Yi He said some of that is transfers between Binance’s own wallets.

Binance called all this a “security incident”. It is a lovely phrase, roughly the corporate equivalent of “we’ve had a bit of a week”.

What to do

Our advice, not Binance’s:

• If you use Binance: the company says user funds are safe and covered. We’ve seen nothing saying you need to act, so don’t panic-withdraw because of a headline. Check the official status page before moving funds.
• Expect scams: every big breach brings fake “compensation” and “verify your account” messages. Use only the official app and site, and never share seed phrases or codes.
• If you run infrastructure: ask which single laptops, if compromised, could reach anything that moves money or signs transactions. Separate those machines, and make sure approvers see what they’re actually signing.
• Watch for: Binance’s final incident report, the Proof of Reserves and any further FBI guidance.

This story is still developing, and we’ll update it as facts firm up.