FBI blames North Korea for $6.3bn Binance theft as withdrawals resume
The FBI named North Korea’s TraderTraitor unit on Saturday. Binance reopened withdrawals on Sunday and reported $3.6bn of net outflows in the first 9.5 hours.
Source published · In the Daily Brief of 2 November 2026
Filed under Markets
Hackers took about $6.3bn from Binance on Thursday 29 October, most of it in about 20 minutes across 10 blockchains, according to the blockchain analysis firms TRM Labs and Chainalysis. That is more than four times the previous record, the $1.5bn stolen from Bybit in February 2025. Binance said about $3bn was frozen, including more than $2.3bn by Tether and Circle.
The Federal Bureau of Investigation (FBI) said on Saturday that North Korean actors it calls TraderTraitor were responsible, and asked decentralised-finance services and other firms to block listed addresses. Binance said it had replaced 90% of the assets from its treasury and insurance funds.
Withdrawals resumed at 06:00 UTC on Sunday. In the first 9.5 hours Binance paid out $4.6bn and took in $1bn, a net outflow of $3.6bn, or 2.1% of its roughly $171bn of assets. DefiLlama showed a higher 24-hour figure of $5.8bn. Binance said it had found no evidence of a leaked private key, which Mark Karpeles, the former head of Mt Gox, doubted.