Introduction

The US Federal Bureau of Investigation (FBI) has officially attributed the reported $6.3 billion Binance security breach to North Korean hackers operating under the name TraderTraitor.

The announcement comes as Binance resumes cryptocurrency withdrawals in phases after temporarily suspending the service following the October 29 incident.

The FBI says the attackers converted stolen assets primarily into Ethereum (ETH) and warned that further laundering through decentralized finance (DeFi) platforms and instant cryptocurrency exchange services is expected.

Meanwhile, Binance says it has covered approximately 95% of the stolen assets and will absorb the financial impact rather than pass losses on to customers.

Key Highlights

  • FBI attributes the $6.3 billion Binance theft to North Korea-linked group TraderTraitor.

  • Stolen assets were reportedly converted primarily into Ethereum.

  • Binance has covered approximately 95% of the affected token value.

  • Cryptocurrency withdrawals resumed in phases on November 1.

  • Binance processed approximately $4.65 billion in withdrawals during the initial reopening period.

  • FBI urged crypto platforms to block transactions connected to identified suspicious wallet addresses.

FBI Identifies North Korea-Linked TraderTraitor Group

In its November 1 announcement, the FBI identified North Korean cyber activity known as TraderTraitor as responsible for stealing more than $6 billion in virtual assets from Binance.

The agency said investigators observed the attackers converting stolen cryptocurrencies primarily into Ethereum.

The FBI also warned that the funds could be moved through DeFi platforms and instant cryptocurrency exchange services to complicate recovery efforts.

It urged cryptocurrency exchanges, blockchain analytics companies and other digital-asset service providers to monitor the identified wallet addresses and block transactions connected to the stolen funds.

TraderTraitor has previously been linked to major cryptocurrency thefts, including the approximately $1.5 billion Bybit incident in February 2025. <Cite refs={["turn536312news3","turn536312news6","turn536312search0"]}/>

Binance Resumes Withdrawals After Covering Most Losses

Binance temporarily suspended withdrawals following the security incident while it worked to restore affected systems and assess the breach.

The exchange subsequently announced that it would resume withdrawals in phases, beginning November 1.

According to Reuters, Binance said approximately 95% of the stolen token value had been recovered or covered. The remaining 5% consists of less-liquid assets that may take longer to purchase in the required quantities.

Binance said it would absorb the financial impact using company resources and its emergency protection funds, rather than passing the losses to customers. <Cite refs={["turn536312news17","turn536312search2"]}/>

Billions in Withdrawals Processed After Reopening

The reopening triggered substantial customer activity.

According to Binance figures reported by Euronews, the exchange processed approximately:

  • $4.65 billion in withdrawals.

  • $1.01 billion in deposits.

  • $3.64 billion in net outflows.

The net outflow represented approximately 2.1% of the assets managed by Binance.

Despite the large withdrawal volume, the exchange continued processing transactions after reopening its services in phases. <Cite refs={["turn536312search1"]}/>

What Happens Next?

Investigators will continue tracking the movement of stolen funds, particularly assets converted into Ethereum and transferred through other blockchain networks.

Crypto exchanges and stablecoin issuers may also face increased pressure to identify and block transactions associated with the reported theft.

For Binance, the next priorities include completing its security review, sourcing the remaining less-liquid tokens and maintaining customer confidence.

Final Takeaway

The FBI's attribution of the Binance hack to North Korea-linked TraderTraitor adds an official law-enforcement dimension to one of the largest reported cryptocurrency thefts.

Although Binance has covered most of the affected assets and resumed withdrawals, the investigation remains active. The movement of stolen funds through Ethereum and other crypto services will be a major focus for investigators and the wider digital-asset industry.

The incident also highlights the importance of exchange security, cross-border cooperation and blockchain transaction monitoring.