Binance Hack Attributed to North Korea TraderTraitor as Withdrawals Resume

The FBI on November 1 attributed the October 29 theft of approximately $6.3 billion from Binance hot wallets to North Korea's state-sponsored TraderTraitor group. The agency cited on- and off-chain intelligence shared with the U.S. Secret Service and IRS Criminal Investigation division.

Binance Hack Attribution and Evidence

Investigators stated that the funds were drained across roughly ten blockchains, primarily Ethereum, in about 20 minutes beginning around 20:05 UTC. Most assets were converted to ETH and are expected to move through DeFi protocols and instant-swap services. The FBI published lists of associated ETH, BTC and SOL addresses and asked node operators and platforms to monitor or block related activity.

Private analytics firms including TRM Labs, Chainalysis and Elliptic had already linked the incident to TraderTraitor with high confidence before the official statement. They pointed to pre-staged signatures, operator wallets funded via Tornado Cash, and commingling of funds with earlier North Korea-linked exploits such as the Bitget theft. TraderTraitor is described as a subunit of the Lazarus Group focused on cryptocurrency theft to circumvent sanctions; the operation is the largest single crypto heist recorded to date.

Binance traced initial access to a compromised DevOps engineer's laptop and later described a more complex multi-point breach. The exchange confirmed that private keys were not leaked. It has covered more than 90 percent of losses, approximately $6 billion, through company reserves, the SAFU fund and futures insurance, leaving only less-liquid tokens to be replaced.

Withdrawal Resumption and Institutional Outflows

Binance began phased reopening of withdrawals at approximately 06:00 UTC on November 1. By midday the platform had processed $4.65 billion in withdrawals and $1.01 billion in deposits, producing a net outflow of $3.64 billion, or 2.1 percent of the $171 billion assets under management reported in the October 28 proof-of-reserves statement. Trading volumes spiked initially then returned to normal ranges.

Binance stated that major assets including BTC, ETH, USDT and BNB remain fully backed. A zero-knowledge proof update to the proof-of-reserves figures is scheduled for November 2. Regulators and service providers are expected to continue monitoring the published addresses for further laundering attempts or freezes.

Background on TraderTraitor and Market Context

North Korea-linked actors have conducted multiple high-value cryptocurrency thefts in recent years, including the February 2025 Bybit incident that removed $1.5 billion. The current case follows the same pattern of rapid movement across chains and use of mixing services. Earlier coverage of the initial breach is available at /news/2026-11-01-binance-hack-6-3-billion-theft.

Industry observers note that the scale of the loss and the speed of the FBI attribution may prompt exchanges to accelerate multi-signature and hardware isolation requirements for hot wallets. Service providers have already begun evaluating the listed addresses against their compliance tools.