FBI: North Korea behind $6.3B Binance heist

FBI says North Korea took $6B+ from Binance; Binance says about 90% of affected assets are re-backed.

The FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about Oct. 29. It calls the activity 'TraderTraitor'. CNBC reports around $6.3 billion was taken from Binance's hot wallets, a record crypto theft.

The FBI, with the USSS and IRS-CI, says it has seen the actors converting stolen assets primarily into Ethereum and expects further laundering through DeFi and instant swap services. Per The Verge, the FBI offered few other details or evidence.

Binance says it has restored backing for about 90% of affected assets, using its SAFU fund, part of its Futures insurance fund and its corporate treasury. CNBC notes that does not mean 90% of the funds were recovered from the attacker. Withdrawals resumed Sunday in phases, starting with Bitcoin.

How the attack happened is still unclear. The New York Times has published an account of the first 24 hours at the exchange; only its summary was available to us.

Watch for: the remaining 10% of assets, and any evidence the FBI releases.

The facts we checked

According to the FBI, Binance, The Verge and CNBC. The New York Times account is cited from its published summary only.

1. The FBI said North Korea was responsible for the theft of more than $6 billion USD in virtual assets from Binance, on or about October 29, 2026.Fact · The Verge
2. The FBI refers to this North Korean activity as 'TraderTraitor'.Fact · The Verge
3. The FBI, with partners at the USSS and IRS-CI, said it has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH).Fact · The Verge
4. The FBI expects the assets to be further laundered through DeFi and instant swap services.Fact · The Verge
5. The Verge reports the FBI offered few other details or evidence.Reported · The Verge
6. Around $6.3 billion in token assets was stolen from Binance's hot wallets, a record crypto theft.Figure · CNBC
7. Binance says it has restored backing for about 90% of the affected assets. CNBC notes this does not mean 90% of the funds were recovered from the attacker.Reported · CNBC
8. Binance said the outstanding 10% is tokens outside its top 10 that are 'less liquid, which means they may take longer to source in the required amounts.'Quote · CNBC
9. Binance said it is using its Secure Asset Fund for Users (SAFU), a portion of its Futures insurance fund and its corporate treasury to replenish the assets.Reported · CNBC
10. Binance said: 'All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%.'Quote · CNBC
11. Binance resumed withdrawals on Sunday, starting with the Bitcoin network and later restoring the Ethereum Network and BNB Smart Chain, in a phased reopening after freezing them following the hack.Reported · CNBC
12. How the attack happened is still unclear. Binance first said it may involve a compromised DevOps engineer's laptop; Co-CEO Richard Teng later said the attack involved a more complex process than misuse of a single engineer's permissions.Reported · CNBC
13. TRM Labs had initially pointed to North Korean hackers, saying several features match earlier North Korea-linked heists including the Bybit hack and the KelpDAO hack in April 2026.Reported · CNBC
14. The New York Times published an account of the first 24 hours at the exchange, described in its summary as including a war room, a global conference call and a founder who live-posted about the heist. Only the summary was available.Reported · The New York Times

Sources

• The VergeNorth Korea linked to massive Binance crypto heist
• CNBCBinance resumes withdrawals following $6.3 billion hack, says 90% of stolen user assets are covered
• The New York TimesHow Binance’s $6.3 Billion Hack Went Down
• The VergeBinance CEO says 90 percent of stolen assets have been ‘replenished’