FBI Attributes $6B Binance Hack to North Korea as Exchange Resumes Withdrawals

The FBI has confirmed that North Korea was behind last week's theft of more than $6 billion from Binance, as the exchange began reopening withdrawals and reported billions of dollars leaving the platform.

In an alert published on Saturday, the FBI said the attack was carried out by North Korean hackers it refers to as "TraderTraitor," confirming the attribution blockchain analytics firms TRM Labs and Chainalysis made on Friday.

The FBI, together with the Secret Service and IRS Criminal Investigation, has seen the hackers converting stolen assets mainly into Ethereum, and expects them to launder the funds further through DeFi and instant swap services, the bureau said. It urged node operators, instant exchanges, DeFi services, blockchain analytics firms and other crypto businesses to block transactions involving hundreds of Ethereum addresses, 19 Bitcoin addresses and one Solana address it linked to the theft.

The Secret Service, which is also investigating the theft, said on Sunday that its investigators worked with industry partners to identify and freeze "a significant portion" of the stolen crypto within minutes of the attack. That work continues with the FBI, IRS Criminal Investigation, the U.S. Attorney's Offices for Washington, D.C. and the Central District of California, and the Justice Department's computer crime and national security divisions, the agency said.

The laundering is already well underway. After the attack, the hackers moved more than $500 million on Tron through more than 1,000 addresses, over 3,000 deposits and several Tron-based DeFi protocols, blockchain analytics firm Chainalysis said on Sunday. Most of those staging wallets have now been drained, with funds leaving Tron through cross-chain services including Chainflip, Relay, THORChain and NEAR for dozens of fresh wallets on Ethereum, Bitcoin and other chains, and the launderers have started moving onto Solana, the firm said.

Withdrawals resume

Binance began restoring withdrawals in phases at 1 a.m. ET on Sunday, and all 15 networks and assets in its first phase were available by 7:36 a.m. ET. In the first nine and a half hours, it processed $4.649 billion in withdrawals and $1.01 billion in deposits, a net outflow of about $3.64 billion, the exchange said.

That represents 2.1% of the $171 billion in assets Binance reported in its most recent proof of reserves, from October 28, according to the exchange. "After an initial spike, withdrawal volumes have declined and are stabilising as expected," Binance said. It took a new reserves snapshot on October 31 and expects to publish an updated report on Monday.

As withdrawals began, CEO Richard Teng said Binance had replenished approximately 95% of the affected assets. "Binance will absorb the financial impact of the stolen funds, not our users," he wrote.

Binance has since reopened withdrawals on more networks, including Zcash, TON and Sui, and on Monday restored fiat withdrawals in U.S. dollars, UAE dirhams, Vietnamese dong, Philippine pesos and Indonesian rupiah.

"Our top priority right now is to ensure the environment is secure, after which users can withdraw their funds and Binance can resume operations," Binance co-CEO Yi He said on X on Monday, Reuters reported. Binance said it has raised $6 billion to cover the losses from its corporate treasury, an insurance fund and its SAFU emergency fund, according to Reuters, which also reported that Circle had frozen more than $1.1 billion in USDC.

Data from DefiLlama, which tracks the public wallets of exchanges, put Binance's total assets at about $127.6 billion on Monday. More than $6 billion left wallets associated with Binance over 24 hours after withdrawals reopened, CoinDesk reported, citing DefiLlama, though those movements can include transfers between Binance's own wallets. Rival exchanges OKX and Bybit recorded net inflows of about $450 million and $134 million, respectively, during Binance's reopening.

The hack has also rattled institutional investors. Spot Bitcoin ETFs shed $643.2 million on Friday, the first full trading session after the hack, leaving the funds with roughly $516 million in net outflows for October. "A hack at a crypto exchange is bank robbery at the speed of the internet," TRM Labs' Ari Redbord told Reuters.