The FBI attributed the Oct. 29 theft of $6.3 billion in virtual assets from Binance to North Korea’s TraderTraitor group, but investigators are still examining how attackers got in and what can be recovered.
What investigators know about the attack
Binance says attackers drained assets from its hot-wallet infrastructure, not thousands of customers’ individual accounts, and that it will replace the shortfall. Binance first said a compromised employee laptop may have opened access to an internal service used to submit withdrawals. It later reported additional breach points and no evidence that wallet private keys were exposed. The company has not published a full technical account.
TRM Labs says that on Ethereum, the attacker used a wallet feature to direct Binance’s hot wallet to move assets under the attacker’s control. On other networks, the transfers appeared to be ordinarily signed transactions. TRM says its findings point to a compromise of the exchange’s transaction-signing infrastructure. If so, attackers may have found a way to make the system approve transfers that appeared valid, rather than stealing a master key.
What supports the North Korea attribution
The FBI’s public attribution followed conclusions by blockchain-analysis firms, but it has not released a full explanation of its evidence. TRM says its assessment draws on on-chain and off-chain intelligence and similarities to earlier North Korean-linked thefts. Chainalysis says stolen Binance funds were mixed with funds from another theft it attributed to North Korea. The FBI says investigators saw the attackers convert stolen assets primarily into Ethereum and lists wallet addresses it associates with TraderTraitor. These are investigative findings, not a public court judgment identifying individual perpetrators.
In February 2025, the FBI blamed TraderTraitor for stealing about $1.5 billion from crypto exchange Bybit. Chainalysis later estimated that North Korean hackers stole $2.02 billion in crypto during 2025 alone. U.S. Treasury officials say state-linked cyber theft and laundering help Pyongyang raise money for weapons programs while sanctions limit its access to conventional finance. Public evidence does not establish where every dollar stolen from Binance would ultimately go.
Why recovering the funds may be difficult
The laundering effort aims to make stolen crypto harder to trace, freeze and convert into spendable money. Blockchains record transfers publicly, but wallet addresses do not automatically identify their owners. The FBI expects the funds to move through decentralized-finance and instant-swap services and has asked exchanges, node operators and other crypto businesses to block transactions linked to listed addresses.
Stablecoin issuers can freeze tokens linked to flagged addresses, but Bitcoin and Ethereum have no central issuer with the same control. Binance said about $3 billion in assets had been frozen; TRM’s early tally was roughly $2.7 billion and estimated that substantial bitcoin and ether remained beyond an issuer’s reach. A freeze does not return the money: legal and operational steps are still needed to transfer control.
Binance’s plan for customers
Binance said it had replenished 90% of the affected amount using its emergency user-protection fund, part of its futures insurance fund and corporate money. It said the remaining 10% consists of less-liquid tokens it is still sourcing. The company has promised to absorb the financial impact rather than pass it to users.
Binance scheduled a first phase of withdrawals for Nov. 1, between 06:00 and 09:00 UTC, with more networks to reopen after security checks. It said a full cryptographic proof of reserves was expected by Nov. 3 and promised a fuller account after its investigation. The next tests are whether Binance can restore access safely and whether investigators and industry partners can turn the transaction trail into funds that are returned.