The FBI has officially attributed the theft of more than $6 billion from Binance to North Korean state-sponsored hackers operating under the designation “TraderTraitor,” confirming what blockchain analytics firms identified within hours of the October 29 breach. According to reporting by Decrypt, the agency released a public alert on Saturday naming the Democratic People’s Republic of Korea and publishing hundreds of associated cryptocurrency addresses in an effort to disrupt the laundering pipeline.
As Binance moved to restore operations, the exchange reported processing $4.65 billion in withdrawals and $1.01 billion in deposits during the first nine and a half hours of resumed service—a net outflow of approximately $3.64 billion, or 2.1% of its $171 billion in reported assets. The breach has already reshaped institutional confidence in crypto custody, with spot Bitcoin ETFs shedding $643.2 million on the hack’s first full trading day.
The Attack and Initial Response
The theft marks one of the largest cryptocurrency heists on record and has triggered a coordinated federal response. The Secret Service, FBI, and IRS Criminal Investigation disclosed they had worked with industry partners to freeze “a significant portion” of stolen assets within minutes of the initial attack. Multiple U.S. Attorney offices and the Justice Department’s computer crime and national security divisions are now investigating.
Binance CEO Richard Teng pledged that the exchange would “absorb the financial impact of the stolen funds, not our users,” and disclosed the company had replenished approximately 95% of affected assets using its corporate treasury, insurance reserves, and SAFU emergency fund. The exchange mobilized a reported $6 billion in resources to cover losses.
The Laundering Pipeline Already Active
Blockchain analytics firms detected sophisticated money-laundering activity almost immediately. Chainalysis reported that within days of the theft, hackers had moved more than $500 million across Tron through more than 1,000 addresses, funneling funds through Tron-based DeFi protocols before routing the proceeds through cross-chain bridges including Chainflip, Relay, THORChain and NEAR to fresh wallets on Ethereum, Bitcoin and Solana.
The FBI urged cryptocurrency exchanges, node operators, DeFi services, and blockchain analytics firms to block transactions tied to hundreds of Ethereum addresses, 19 Bitcoin addresses and one Solana address identified in the breach. The rapid movement of funds underscores the challenge regulators face in intercepting stolen crypto once it enters decentralized finance channels.
Circle, the stablecoin issuer, froze more than $1.1 billion in USDC linked to the theft, representing one of the few successful intervention points in the laundering sequence.
Market Reaction and Competitive Pressures
The hack exposed Binance to immediate competitive pressure from rivals. Data from DefiLlama showed more than $6 billion left Binance wallets during the first 24 hours after withdrawal resumption, though some of this reflected internal wallet transfers. Competing exchanges OKX and Bybit recorded net inflows of approximately $450 million and $134 million respectively during the same period, signaling user flight to perceived safer venues.
Spot Bitcoin ETFs recorded their worst day of the month on Friday, shedding $643.2 million as institutional investors reassessed counterparty risk across the industry. TRM Labs analyst Ari Redbord captured the gravity of the situation in remarks to Reuters: “A hack at a crypto exchange is bank robbery at the speed of the internet.”
Operational Recovery
Binance began phased withdrawal resumption at 1 a.m. ET on Sunday, restoring all 15 networks and assets in its first phase by 7:36 a.m. ET. By Monday, the exchange had expanded withdrawal availability to include fiat channels in U.S. dollars, UAE dirhams, Vietnamese dong, Philippine pesos and Indonesian rupiah. Co-CEO Yi He stated on X that the platform’s “top priority right now is to ensure the environment is secure, after which users can withdraw their funds and Binance can resume operations.”
The exchange published an updated proof-of-reserves report following a new snapshot taken on October 31, though data from DefiLlama placed total assets at approximately $127.6 billion on Monday—below the $171 billion figure from October 28.
The attribution to North Korea elevates the incident beyond a typical cybercrime case, potentially triggering additional sanctions scrutiny and heightening tensions between the Biden administration and Pyongyang over state-sponsored financial theft.