Binance Hack, Day Four: FBI Names North Korea as Withdrawals Reopen

Late on Saturday 31 October 2026, the FBI put a name to the biggest crypto theft on record. "The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026," the bureau said. Its cyber division posted the notice on X at 22:36 UTC; news outlets had picked it up from about 21:40 UTC. A day earlier, no government had said who did it.

Less than eight hours later, at 06:20 UTC on Sunday 1 November, Binance announced that customers could take bitcoin out again, the first withdrawals since the theft. Ether, USDT, USDC and BNB on two more networks followed at 07:49 UTC. Binance says it has now covered about 95% of the stolen value with its own money.

The theft began at about 20:05 UTC on Thursday 29 October, when Binance's hot wallets, the internet-connected accounts it pays withdrawals from, were emptied across 10 blockchains. Binance puts the loss at about $6.3 billion. Day one traced the break-in to an engineer's hacked laptop, day two brought $6.34 billion set aside to repay customers, and day three brought a promise of "full responsibility" and withdrawals by Sunday. All three are in the earlier CMZ reports.

What the FBI said

Attribution means a government saying, on the record, who it believes committed a crime. Until Saturday only private tracing firms, TRM Labs, Elliptic and Chainalysis, had pointed at North Korea. That is a private detective's opinion. The FBI's alert is the police naming a suspect in public. It is not a charge: nobody has been charged, arrested or sanctioned over the theft, and North Korea has not responded.

The FBI calls this "specific North Korean malicious cyber activity" TraderTraitor. Security firms usually group TraderTraitor with the Lazarus Group, the umbrella name for North Korea's state hackers. The same name was used for the $1.5 billion theft from the exchange Bybit in February 2025, which the FBI attributed five days after it happened. This time it took about two days.

The alert says the FBI, the US Secret Service (USSS) and IRS Criminal Investigation (IRS-CI) "observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH)", and expect the money to be "further laundered by converting them using DeFi and instant swap services". DeFi, short for decentralised finance, means trading services run by code rather than by a company. The three agencies urged "THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using". The alert lists those addresses. It works like police circulating the serial numbers of stolen banknotes to every bank and bureau de change.

Binance thanked the FBI's cyber division on X at 05:05 UTC on Sunday. Changpeng Zhao, Binance's founder and former chief executive, wrote at 05:45 UTC that US agencies "provided vital help in this incident, including tracking, freezing, etc."

Laundering on autopilot

Laundering is turning stolen money into money that cannot be traced back to the crime. Here, much of it appears to be run by software. "The Binance hack is laundering on autopilot," the tracing firm Elliptic said on Saturday. "The main Tron distribution wallet has paid out every hour for 31 hours. Its longest pause was 46 minutes." Payments into THORChain repeated the same amounts, one of them 19 times, and "When a bridge rejected deposits, the funds were re-sent automatically from new wallets." It is a standing order at a bank, set to pay out every hour whether anyone is watching or not.

THORChain is a service for swapping one blockchain's coins for another's, like a currency exchange booth with no staff, run by independent computers called THORNodes. On Saturday it stalled the thieves by accident. Chainalysis said a reorg on Ethereum, when the network briefly rewrites its most recent blocks, much as a bank might reverse a batch of entries, made THORChain refund one 10 ETH deposit twice. That triggered an "emergency pause" of all cross-chain swaps, "including DPRK's money launderers". When swaps resumed has not been reported. On Sunday, according to the news service Wu Blockchain, THORChain co-founder Chad Barraford answered the FBI by saying THORNode operators hold no private information, since all the data is public in real time.

The attacker is also selling. The tracking account Lookonchain counted more than 130 smaller tokens dumped on Ethereum-style networks for 123,400 ether ($277.26 million) and 1.69 million USDC, about $279 million in all. One sale went badly, by Lookonchain's account: 908,793 PROM tokens, worth about $5 million, sold into an almost empty trading pool on Uniswap for 0.0316 ether, about $71. It is a block of shares dumped on a stock with no buyers. The analyst Specter reported that about $38 million passed through the Relay bridge in seven hours; Relay has not commented.

Elliptic's free blocklist of attacker addresses, which exchanges use to refuse the money, passed 2,800 entries on Saturday. Binance says about $3 billion has been frozen. Elliptic's count puts about $3.2 billion in coins that no issuer can freeze, such as bitcoin and ether, still in the attacker's hands. Ari Redbord of TRM Labs told ABC News in Australia that the laundering "could take months". "It's bank robbery, in this case, at the speed of the internet."

The doors reopen

Reopening withdrawals is the real test. A bank that has been robbed can say anything while its doors are shut. When they open, customers find out whether their money is there. When FTX stopped withdrawals in November 2022, it never reopened.

Binance set the timetable at 04:08 UTC on Sunday in "Recovery Update #4". "Binance is preparing to resume phase one of withdrawals on 2026-11-01 between 06:00 and 09:00 (UTC)," it said, starting with the coins customers had asked for most in the past week. Phase one covers 15 networks: Bitcoin (BTC); Ethereum (ETH, USDT, USDC); BNB Smart Chain (BNB, USDT, USDC); Tron (TRX, USDT); Solana (SOL, USDT, USDC); XRP Ledger (XRP); Zcash (ZEC); Dogecoin (DOGE); TON (USDT, GRAM); Polygon (POL, USDT, USDC); Avalanche C-Chain (AVAX, USDT, USDC); Arbitrum (ETH, USDT, USDC, ARB); Base (ETH, USDC); Optimism (ETH, USDT, USDC); and Sui (SUI). Deposits stayed open throughout. Co-chief executive Yi He said wallets for other coins were "still undergoing repeated security audits and perimeter checks" and would follow by market value, funds held and number of users. No date was given.

Bitcoin came first; Binance announced it at 06:20 UTC, though one customer reported it live at 06:10. At 06:53 UTC Binance said all withdrawals would now come from newly created wallets, added to its public list of reserve addresses. When about 1,000 bitcoin moved to those unfamiliar wallets, Eowyn Chen, whose X profile says she helps Binance with its communications, said it was "internal transfer. Funds are safe." At 07:18 UTC Yi He said: "Things are currently running fairly smoothly." Ethereum and BNB Smart Chain opened at 07:49 UTC. By the end of the window at 09:00 UTC, Binance had announced 3 of the 15 networks open and said the rest would follow "in phases following the completion of our security checks". No total for the money withdrawn has been published.

Covered is not recovered

"Binance has now covered approximately 95% of the impacted amount, up from 90% in our prior update," the update said. The missing 5% is in smaller tokens that are "less liquid in the market and take longer time to source". Covered means Binance bought replacement coins with its own money. It does not mean the stolen coins came back. Part of the money is half of the Secure Asset Fund for Users (SAFU), Binance's emergency fund; a 7,499 bitcoin transfer, about $581 million, left it on Saturday.

"Binance will bear the financial impact of the stolen funds. These losses will not be passed on to users," the update said. None of the 95% has been checked by an outsider yet. Binance's Proof of Reserves, a public count of whether it holds what it owes customers, is due on Tuesday 3 November. Its report on how the attack worked is still to come.