FBI blames North Korea for $6.3B Binance theft; Pyongyang denies it

What to know

• Binance says hackers took more than $6 billion in digital assets on Oct. 29. Blockchain intelligence firm TRM Labs put the figure at about $6.36 billion across ten blockchains and called it "the largest crypto theft on record"; Elliptic's count is about $6.43 billion.
• The FBI said on Saturday, Oct. 31, that the theft was the work of TraderTraitor, a North Korean group it also blames for the roughly $1.5 billion Bybit hack in February 2025, according to The Record and Al Jazeera.
• Binance said it had replaced about 90 percent of the stolen assets by Oct. 31 using its own money, and CoinDesk reported that figure reached about 95 percent by Sunday, Nov. 1. The exchange has promised customers will not absorb the loss.
• TRM Labs and Elliptic say roughly $2.7 billion to $2.85 billion of the proceeds has been frozen or seized by token issuers and other partners, while Elliptic estimates about $3.24 billion still sits in addresses it links to the attacker.
• Kim Yo Jong, the sister of North Korean leader Kim Jong Un, dismissed the FBI's announcement as "a trite provocation" and "an absurd rhetoric," The Associated Press reported. Trump said at his Mar-a-Lago estate: "We don't know if it's North Korea, but if it is, we'll talk to North Korea about it."
• Attributing a hack to a state is a claim made by investigators, not an established fact. The FBI, TRM Labs, Chainalysis and Elliptic are the parties making it here.

How much was taken, and when?

Binance, the world's largest cryptocurrency exchange by trading volume, says hackers drained more than $6 billion in digital assets from its wallets on Oct. 29, 2026. The Associated Press, in an account published by PBS NewsHour, described the loss as about $6.3 billion in bitcoin and other digital currency and said the theft took only minutes.

The three blockchain intelligence firms that have published counts do not agree on a single number, because each values the stolen tokens at a different moment. TRM Labs said about $6.36 billion moved out of Binance wallets across ten blockchains, valued at the time of each transfer, and that the same assets were worth roughly $6.23 billion at the prices prevailing when it published. TRM Labs called the episode "the largest crypto theft on record." Elliptic, in an analysis updated through Nov. 2, put the total at about $6.43 billion.

The timeline the firms describe is unusually compressed. According to TRM Labs, most of the outflows happened in about 20 minutes beginning at 20:05 UTC on Oct. 29, with a second wave starting around 23:05 UTC that targeted the Avalanche and Polygon networks. Elliptic said the theft ran from 20:05 to 23:56 UTC. The FBI said the assets were taken "on or about October 29," according to The Korea Times.

TRM Labs published a chain-by-chain breakdown: about 167,464 ether and 63 separate tokens, including 1.615 billion USDT, from one Ethereum hot wallet; 18,270 bitcoin; 233.46 million XRP from five Binance wallets; 612.7 million USDT and 46.4 million TRX on Tron; and roughly 970,500 SOL on Solana. For scale, TRM Labs noted the haul is about four times the size of the roughly $1.5 billion Bybit theft of February 2025, which the FBI also attributed to the same group. NewsCubby covered the first 24 hours of the breach, including the early asset freezes and the suspension of withdrawals, in its Oct. 30 briefing on the Binance hack and the frozen funds.

How did the attackers get in, and how did the money move?

Binance has not published a root-cause finding. Co-CEO Richard Teng, speaking in a video posted to X on Friday, Oct. 30, described a "complex attack" that involved a compromised laptop and malicious software built to delete evidence of the intruders' activity, Al Jazeera reported. Teng also said the attack was not the work of one person and that the attackers used a "self-destruct mechanism" that complicates the investigation, according to The Associated Press. "We are working nonstop to resolve this," Teng said.

TRM Labs' own assessment is that the attacker obtained the ability to make Binance's hot wallet signing system approve transactions across multiple chains. On Ethereum, TRM Labs said the attacker used EIP-7702, a feature that lets an ordinary wallet delegate its behavior to a contract, to make a Binance hot wallet run a sweeper contract; a single transaction carried 50 pre-signed authorizations, one of which matched the wallet's nonce. On the nine other affected chains, TRM Labs said the funds left through ordinary signed transfers with no delegation involved. TRM Labs also said withdrawals from the Tornado Cash mixer funded the operator wallet from Oct. 28, and that the attack code was tested on other wallets before being used against Binance.

What happened next is, by Elliptic's description, the fastest large-scale laundering operation the firm has documented. Elliptic said that in under four days the proceeds passed through about 12,000 wallets on 11 blockchains in more than 40,000 transactions, a pattern it called "highly complex and clearly automated." On Tron alone, Elliptic counted roughly 7,700 receiving addresses and about 32,000 transactions. It said at least seven cross-chain bridges were used, that about 128 million TRX was routed through a JustLend lending vault on Oct. 31 and paid out to 16 new addresses, and that about 28 bitcoin, worth roughly $2.2 million, went through 18 coinjoin transactions beginning Nov. 1 — the first mixing Elliptic says it has seen with these funds. Elliptic said ether, SOL, NEAR and XRP began moving from Nov. 1, and that the 233 million XRP went to six new addresses on Nov. 2.

Elliptic also addressed a claim circulating about the speed of the operation, saying its analysts found fixed timing, set amounts and blind retries consistent with conventional automation and that "nothing we have seen shows an AI agent making decisions."

Some of the money did not get away. TRM Labs said roughly $2.7 billion was frozen by Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council. Elliptic, writing days later, put the frozen or seized total at about $2.85 billion and said about $3.24 billion remains in addresses it links to the attacker, mostly in ether and bitcoin, with a negligible amount cashed out so far. TRM Labs said that before the freezes took hold, the attacker sold about 325 million USDT to market makers for roughly 122,300 ether, at a discount of more than 10 percent.

Who do investigators blame, and what does Pyongyang say?

The FBI issued a statement on Saturday, Oct. 31, attributing the theft to TraderTraitor, a North Korean group. The bureau said it "has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH)" and that "it is expected these assets will then be further laundered by converting them using DeFi and instant swap services," according to The Record. The FBI asked exchanges, decentralized finance operators and other crypto firms to "block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets," and published a list of wallet addresses. The Korea Times reported that the U.S. Secret Service and the Internal Revenue Service's Criminal Investigation division are assisting.

Blockchain firms reached similar conclusions before the FBI spoke. TRM Labs said it attributed the attack to TraderTraitor "with high confidence," citing what it called robust on-chain and off-chain intelligence. A Chainalysis spokesperson told CNN the firm had "high confidence" that North Korea was behind the hack, and said its strongest evidence was that the stolen Binance funds commingled "in real time" with proceeds of the Bitget exploit in September 2026, which had already been attributed to North Korean actors. Chainalysis co-founder and chief executive Jonathan Levin wrote on X that TraderTraitor likely carried out the hack, The Associated Press reported. Elliptic said about $16 million went to addresses holding Bitget proceeds and that the unmoved funds are "very likely still held by North Korea," while noting that on-chain data alone cannot show whether any funds were handed to third-party laundering networks.

North Korea has now responded, and it denies it. Kim Yo Jong, the influential sister of leader Kim Jong Un, dismissed the FBI's announcement as "a trite provocation" and "an absurd rhetoric," according to The Associated Press. The statement was dated Nov. 2 and carried by the state news agency KCNA. "This is not the first time that the U.S. has attempted to spread misunderstanding of the DPRK in the international community," she said, using the initials of the country's official name. She added that "on this occasion, we confirmed Washington's hostile attitude toward the DPRK once again" and that "we have issues to reconsider in diverse aspects as regards the very unpleasant U.S. hostile attitude." Her statement did not address the technical findings published by the FBI or the blockchain firms.

Trump, asked about the theft at his Mar-a-Lago estate in Palm Beach, Florida, on Saturday, said: "I'm not concerned. We're learning about it." He added, in remarks reported by The Korea Times: "We don't know if it's North Korea, but if it is, we'll talk to North Korea about it." Earlier, at the White House, he had answered a question about North Korean involvement by saying, "We're looking at that," according to The Associated Press. The Korea Times noted that Secretary of State Marco Rubio has said Trump remains open to talks if Pyongyang is willing to address U.S. and allied concerns, and that no meeting has been scheduled.

South Korea's Foreign Ministry said on Monday that North Korea's illicit cyber activities are a growing threat to the global digital economy and that Seoul is working closely with Washington and the wider international community, The Associated Press reported.

Are customers' funds safe?

Binance suspended withdrawals after the breach while keeping deposits open, and said it would cover the losses itself. Al Jazeera reported that the exchange drew on a $1 billion Secure Asset Fund for Users, a bitcoin reserve fund, part of its Futures Insurance Fund and its corporate treasury, and that it had replaced 90 percent of the stolen amount by buying new tokens with company funds, with the remaining 10 percent held in less liquid tokens that would take longer to acquire. Binance said it would keep buying until every token reached full coverage. NewsCubby reported that stage of the response in its Oct. 31 briefing on the 90 percent replenishment and the planned Sunday reopening.

By Sunday, Nov. 1, CoinDesk reported that Binance had covered about 95 percent of the loss, that its largest holdings were fully backed, and that it had committed to restoring the Secure Asset Fund for Users to about $1 billion. Binance also published a proof-of-reserves snapshot that it said lets users verify their assets are backed at a minimum one-to-one ratio, according to Al Jazeera. Teng said user assets "are held under Binance's established security architecture" and that "the vast majority sits in cold wallets," The Associated Press reported. A Binance spokesperson declined to confirm North Korean involvement and said the company is "working closely with our law enforcement partners."

Withdrawals reopened in phases on Sunday, Nov. 1. CoinDesk, citing wallet-tracking data from DefiLlama, reported that more than $6 billion flowed out of Binance-associated wallets once withdrawals resumed, about 3.6 percent of the $171 billion the tracker recorded before the attack. Binance's own accounting, as reported by CoinDesk, showed $4.649 billion in withdrawals against $1.01 billion in deposits in the first nine and a half hours, a net outflow of roughly $3.64 billion, or 2.1 percent of assets under management. Binance founder and former chief executive Changpeng Zhao wrote on X that most of the net outflow came in the first couple of hours and that "98% choose to stay."

Ari Redbord, chief policy officer at TRM Labs, told The Associated Press the hackers are likely to break the assets into smaller pieces and move them through smaller exchanges, possibly over months. "It's bank robbery, in this case, at the speed of the Internet," he said, adding that investigators can follow the funds in real time to build cases and seize assets: "It's just this cat and mouse game." Elliptic said it expects the ether to be swapped into bitcoin in small batches and cashed out through over-the-counter brokers over a period of months, based on what happened after the Bybit theft.

What are markets and regulators doing about it?

Crypto prices fell on Friday, Oct. 30, as Binance tried to reassure customers, Al Jazeera reported, and the sell-off came in a week of broader market stress in which the Nasdaq 100 dropped 3.5 percent on Friday and the Philadelphia Semiconductor Index fell 7 percent, according to CoinDesk. NewsCubby covered one driver of that same week's equity turbulence in its report on Alphabet's 12.29 percent drop and the tougher market test for AI spending.

By Monday morning in Asia, CoinDesk reported that bitcoin had risen about 1 percent to roughly $78,600, a third straight daily gain, after dipping to about $77,600 late Sunday; ether was up nearly 2 percent just above $2,300, and Binance's BNB token was up nearly 2 percent at about $713. Jeff Mei, chief operating officer at the crypto exchange BTSE, told CoinDesk: "We believe that given last week's Fed commentary, macro pressures will continue to keep interest rates high."

In Washington, the theft has fed an existing fight over crypto oversight rather than producing a single regulatory response. Bitcoin.com News reported that Commodity Futures Trading Commission Chairman Michael Selig, in an Oct. 30 CNBC interview, pointed to a voluntary federal registration route for exchanges: "We want to offer these exchanges a federal option to come and register with the CFTC." The proposal builds on an initiative the agency opened on Oct. 5, with public comments due by Dec. 14, and the CFTC cannot compel centralized exchanges to register without further authority from Congress. Sen. Cynthia Lummis, a Wyoming Republican, used the hack to press for the stalled CLARITY Act, writing on X on Oct. 30 that "every minute lost is money gone for good"; the bill fell short of the 60 votes it needed in a Senate procedural vote on Sept. 15. Amanda Fischer of the advocacy group Better Markets disputed her reading, arguing that existing mechanisms already allowed firms to freeze suspicious transactions voluntarily.

*Want more? Explore today's headlines on NewsCubby and join My Day free to make NewsCubby part of your day.*

*ARCHIVE PHOTO: The Juche Tower in Pyongyang, North Korea, photographed on Oct. 14, 2015. Photo: Uwe Brodrecht / Wikimedia Commons / CC BY-SA 2.0.*

*NewsCubby articles are produced with AI assistance and reviewed by humans.*