Europe·since 29 Oct·5 entries
Binance hack: $6.3 billion crypto theft
Binance says it is replacing the roughly $6.3 billion stolen in a cyberattack with company funds and began phased withdrawals on 1 November 2026, while the FBI attributes the theft to North Korea's TraderTraitor operation and Pyongyang denies it.
AI text how it is made
This week4 entries
State of playtoday 01:43
Attribution
The FBI published a cyber alert naming North Korea as responsible for stealing more than $6 billion in virtual assets from Binance on or around 29 October. It identified the operation as TraderTraitor, the group US authorities also associate with the 2025 Bybit theft.
On 2 November Kim Yo Jong, sister of Kim Jong Un, rejected the claim through state media, calling it absurd and a provocation. TRM Labs traced about $6.36 billion across ten blockchains, mostly within about 20 minutes.
Recovery and Reopening
Binance says it is using more than $6.34 billion in company funds to replace the stolen assets, covering 95% of the loss. Less-liquid tokens may take longer to source. It says it has located or frozen roughly $3 billion.
Withdrawals reopened in phases on 1 November after about two and a half days of suspension. Reported net outflows that day range from $3.6 billion (BBC) to $4.72 billion (Reuters). How the breach occurred is still unpublished.
The test now is whether later phases restore all tokens without a further surge in outflows.
What comes next
Open questions
- How long will it take Binance to cover the remaining 5% held in less-liquid tokens?
- Can the FBI or Binance freeze more of the ether being laundered?
Who is who7
Binance Crypto exchange
Says company funds have covered 95% of the roughly $6.3 billion stolen and began phased withdrawals on 1 November, with the remaining 5% in less-liquid tokens.
1 Nov
TraderTraitor North Korean hacking operation
Named by the FBI as the operation behind the theft and said to have begun laundering funds through ether.
1 Nov
FBI US federal law enforcement agency
Published a cyber alert attributing the theft of more than $6 billion to North Korea and expects further laundering stages.
1 Nov
Kim Yo Jong Sister of North Korean leader Kim Jong Un
Rejected the FBI attribution on 2 November, calling it absurd rhetoric and a political provocation.
3 Nov
TRM Labs Blockchain analytics firm
Traced about $6.36 billion moving across ten blockchains, mostly within about 20 minutes, and attributes the attack to TraderTraitor.
31 Oct
Chainalysis Blockchain analytics firm
Attributes the attack to the North Korean group TraderTraitor.
31 Oct
Richard Teng Binance chief executive
Named among the entities in coverage of Binance reopening withdrawals after the hack.
2 Nov
Numbers
Share of stolen funds covered by Binance (%)
90→95 %
31/10 → 01/11 · reuters.com
Promises1
Binancekept
Binance will reopen withdrawals on Sunday, 1 November 2026, subject to security checks.
31 Oct · due 1 Nov · pollar.news
Chronicle5 entries since 29 Oct
2–8 November1 entry
Kim Yo Jong, sister of Kim Jong Un, rejected the FBI's attribution of the roughly $6.3 billion Binance theft to TraderTraitor in a statement carried by KCNA on 2 November, calling it absurd rhetoric and a political provocation.
26 October – 1 November3 entries · 1 key
Binance started phased customer withdrawals on 1 November, initially for bitcoin, ether, BNB, Solana, XRP and dogecoin, after raising its replacement of the roughly $6.3 billion stolen from 90% to 95%. The remaining 5% is in less-liquid tokens.
The FBI said in a cyber alert that North Korea stole more than $6 billion in virtual assets from Binance on or around 29 October, naming the TraderTraitor operation. It said laundering via ether had begun and expected further stages.
Binance said on 31 October that company funds have replaced about 90% of the roughly $6.3 billion stolen. The remainder is in less-liquid tokens. The exchange plans to restore withdrawals on Sunday, 1 November, pending security checks.
AI writes this thread from the sources cited with every entry. How it works