Binance's $6.3B Hack: FBI Blames North Korea's TraderTraitor as Withdrawals Reopen

The largest crypto theft on record started on a DevOps engineer's laptop. Binance says it has covered 95% of the stolen assets, reopened withdrawals on 15 networks and owes users a full proof of reserves on November 3.

The Proof DeskNov 2, 2026 · 7 min read

Headline card reading Binance $6.3B hack, FBI attributes it to North Korea's TraderTraitor, withdrawals reopen

Four days after attackers drained roughly $6.3 billion from Binance's hot wallets, the story has shifted from what happened to whether the world's largest crypto exchange can absorb it. The FBI formally attributed the theft to North Korea's TraderTraitor group on October 31, Binance reopened withdrawals on 15 networks on November 1, and the exchange says it has already replaced about 95% of the stolen assets from its own funds.

The more uncomfortable lesson is how it started. According to Binance's own preliminary findings, no wallet private key leaked. The way in appears to have been a compromised DevOps engineer's laptop, which led to an internal service able to submit withdrawals - the same developer-endpoint-to-signing-infrastructure playbook TraderTraitor used against Bybit in 2025.

What happened on October 29

Binance says its hot wallets were compromised "at around 2026-10-29 20:05 (UTC)" through unauthorized withdrawals, with an estimated loss of approximately $6.3 billion in token assets. Blockchain analytics firm Arkham traced the outflows from Binance hot wallets to between 4:10 p.m. and 7:05 p.m. ET that Thursday.

TRM Labs estimated that $6.36 billion left Binance wallets across ten blockchains, most of it within about 20 minutes. That makes it the largest crypto theft on record - more than four times the roughly $1.5 billion taken from Bybit in February 2025.

What was taken

18,270 BTC, worth about $1.47 billion
200,630 ETH
1.875 billion USDT and 823 million USDC on Ethereum
233.46 million XRP
970,500 SOL
Plus USDT on other chains

Chart of the assets stolen from Binance per TRM Labs: 18,270 BTC, 200,630 ETH, 1.875 billion USDT, 823 million USDC, 233.46 million XRP and 970,500 SOL — Breakdown of the stolen assets as estimated by TRM Labs.

About the numbers

Binance's headline figure is approximately $6.3 billion. TRM Labs puts it at $6.36 billion and the FBI says "more than $6 billion". The $6.34 billion figure in Binance's updates is the company money it reserved to cover the loss, not the amount stolen.

How the attackers got in

Binance's first update, published October 30, said: "Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop." From there the attacker reached a service container and submitted unauthorized withdrawal transactions. "We have found no evidence of any wallet private key leak," the exchange added. It suspended withdrawals, left deposits running, revoked the affected address authorization and brought in law enforcement and blockchain-intelligence partners.

A second update the same day said further investigation had "uncovered additional points of breach", still with no evidence that private keys leaked. Co-CEO Richard Teng wrote on X that the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action," and that "our investigation has not attributed responsibility to any individual." Binance has promised a detailed technical post-mortem once "every fact is verified". None has been published yet.

Diagram of the attack path: compromised DevOps engineer laptop, internal service container, unauthorized withdrawal submissions, Binance hot wallets, ten blockchains, then conversion to ETH and laundering through DeFi and swap services — The attack path as Binance described it so far. No private-key leak has been found, and additional points of breach are still under investigation.

Why this matters beyond crypto

Hot-wallet security is usually framed as key management. Here the keys reportedly stayed safe; the weak point was an internal service trusted to submit withdrawals and reachable from an engineer's machine. Any organization with privileged internal automation - CI/CD runners, payment services, deploy pipelines - carries the same shape of risk.

FBI: North Korea's TraderTraitor did it

Private-sector attribution came first. TRM Labs attributed the attack "with high confidence" to TraderTraitor, and Chainalysis said it was "likely done by DPRK group TraderTraitor". On October 30 the FBI said only that it "is aware of the incident and is engaged with relevant public and private partners".

On Saturday, October 31, the bureau published an alert titled "North Korea Responsible for $6 Billion+ Binance Attack". It says North Korea's TraderTraitor - also tracked as Lazarus Group, Jade Sleet and APT38 - stole "more than $6 billion USD in virtual assets" from Binance "on or about October 29, 2026". The FBI expects the group to convert the haul mainly into ETH and launder it through DeFi platforms and instant swap services.

Together with the U.S. Secret Service and IRS-CI, the FBI asked exchanges, DeFi services and virtual asset service providers, including THORNode operators, to block transactions with 628 listed addresses: 608 on Ethereum, 19 on Bitcoin and 1 on Solana.

That list will not stay current for long. Chainalysis CEO Jonathan Levin said the attackers have already used "thousands of addresses" and expects that to reach "tens of thousands" in the coming weeks, through "novel automated laundering mechanisms" spanning bridges, instant exchanges and swappers.

A familiar playbook

Bybit, February 2025: $1.5 billion, via a compromised Safe{Wallet} developer's computer
DMM Bitcoin, May 2024: $308 million, after a fake LinkedIn recruiter tricked a Ginco employee into running malicious Python code
Drift, April 2026: $280 million
Bitget, September 2026: reported at about $387.5 million

US intelligence estimates North Korea nets at least $1 billion a year from crypto heists and other financial crime. A single $6 billion theft dwarfs that baseline.

How Binance is covering the loss

"Binance will absorb the financial impact of these stolen funds, not our users," the exchange said in an update signed by co-CEOs Yi He and Richard Teng. It reserved more than $6.34 billion of company funds, including about $5 billion already held in the affected tokens.

Replenishment went from about 80% on October 30 to 90% on October 31 and roughly 95% on November 1. The money comes from a partial deployment of SAFU, the Secure Asset Fund for Users, a portion of the futures insurance fund and Binance's corporate treasury. SAFU is to be topped back up to roughly $1 billion. The remaining 5% is "tokens outside the top ten", less liquid assets Binance is buying through market and OTC channels.

Bar chart of Binance's replenishment of stolen assets: 80% on October 30, 90% on October 31 and 95% on November 1, with about $3 billion frozen and more than $6.34 billion reserved — Replenishment progress from Binance's recovery updates.

Some of the stolen funds are stuck. Binance says about $3 billion of affected assets has been frozen on-chain. Independent tallies are lower: Elliptic counted $2.84 billion in verified freezes as of 08:00 UTC on October 30, mostly USDT and USDC, and CoinDesk reported that stablecoin issuers froze "over $2.4 billion". Bitcoin and ether cannot be frozen the way USDT and USDC can.

Withdrawals reopen and the money moves

Binance's Recovery Update #4 opened phase one of withdrawals between 06:00 and 09:00 UTC on November 1. By 12:36 p.m. UTC, withdrawals were live on all 15 phase-one networks, according to CNBC:

Bitcoin
Ethereum (ETH, USDT, USDC)
BNB Smart Chain (BNB, USDT, USDC)
Tron (TRX, USDT)
Solana (SOL, USDT, USDC)
XRP
Zcash
Dogecoin
TON (USDT, GRAM)
Polygon (POL, USDT, USDC)
Avalanche C-Chain (AVAX, USDT, USDC)
Arbitrum (ETH, USDT, USDC, ARB)
Base (ETH, USDC)
Optimism (ETH, USDT, USDC)
Sui

Other networks will follow "once they are ready"; no dates have been given. Deposits "remain open and are not affected".

Between 06:00 and 15:30 UTC that day, Binance processed $4.65 billion in withdrawals and $1.01 billion in deposits - a net outflow of $3.64 billion, or 2.1% of the $171 billion in total assets shown in its October 28 proof-of-reserves data. Binance says volumes declined and stabilized after an initial spike. DefiLlama, measuring over 24 hours with a different methodology, put net outflows at $5.86 billion.

Chart of Binance flows from 06:00 to 15:30 UTC on November 1: $4.65 billion withdrawn, $1.01 billion deposited, $3.64 billion net outflow, equal to 2.1% of $171 billion in assets — Net outflow in the first 9.5 hours after withdrawals reopened, per Binance figures reported by CNBC.

Founder Changpeng Zhao framed it as a vote of confidence on X: "98% choose to stay!" and "Trust isn't earned by what you say in good times. It's earned by what you do in hard times."

What comes next: proof of reserves on November 3

Binance took a new proof-of-reserves snapshot at 00:00 UTC on October 31 and posted it at binance.com/en/proof-of-reserves. The full zero-knowledge proof takes about 40 to 50 hours to generate and is expected to be complete on Tuesday, November 3 (UTC), after which holders of the ten listed tokens can verify that their balances are backed 1:1.

The exchange says "all BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC balances are fully backed 100%." The proof is what lets users check that claim instead of taking it on faith.

Timeline of the Binance hack from the October 29 hot-wallet drain through the October 31 FBI alert and the November 1 reopening of withdrawals to the November 3 proof of reserves — Key dates from Binance's updates and the FBI alert.

What Binance users should do now

Check withdrawal status for your network before moving funds - phase one covers 15 networks and the rest have no date yet.
Deposits are unaffected, and Binance says it, not users, is absorbing the loss.
Verify your balance against the zero-knowledge proof of reserves once it completes on November 3.
Watch for the post-incident report Binance has promised after the investigation.
Treat unsolicited "refund" or "account verification" messages about the hack as likely phishing.

Sources

FBI alert: https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack
Binance, first security incident update: https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7
Binance, Security Incident Update #2: https://www.binance.com/en/support/announcement/detail/d3306d9dca5243548c813b605e1d1751
Binance, Recovery Update #3: https://www.binance.com/en/support/announcement/detail/1fdf1f61559c401da0435895ffcccb62
Binance, Recovery Update #4: https://www.binance.com/en/support/announcement/detail/73911fb819b240f88b88256bdd318eda
BleepingComputer: https://www.bleepingcomputer.com/news/security/fbi-links-63-billion-binance-crypto-heist-to-north-korean-hackers/
CoinDesk: https://www.coindesk.com/policy/2026/10/31/fbi-confirms-north-korea-s-role-in-usd6-billion-binance-hack-asks-defi-community-to-block-btc-eth-sol-addresses
CNBC: https://www.cnbc.com/2026/11/02/binance-outflow-hack-bitcoin.html
Nextgov/FCW: https://www.nextgov.com/cybersecurity/2026/10/fbi-involved-response-63-billion-binance-hack-linked-north-korea/416946/
Decrypt: https://decrypt.co/382203/binance-finds-additional-points-of-breach-in-6-3b-hack

Key takeaways

Attackers drained approximately $6.3 billion from Binance hot wallets on October 29, 2026 - the largest crypto theft on record.
The FBI attributed the attack to North Korea's TraderTraitor on October 31 and published 628 addresses to block.
Binance's preliminary findings point to a compromised DevOps engineer's laptop, not a leaked private key, plus additional points of breach.
Binance says it has replaced about 95% of the stolen assets from its own funds and reopened withdrawals on 15 networks.
The full zero-knowledge proof of reserves is due on November 3, letting users verify 1:1 backing themselves.