The world’s largest cryptocurrency exchange, Binance, resumed bitcoin withdrawals on Sunday, November 1, 2026, after covering 95 percent of the $6.3 billion in tokens stolen from its platform in what analysts describe as the largest digital heist on record — a theft the FBI has tied to a North Korean state-sponsored hacking unit.
The FBI said on Saturday, October 31, that the unit known as TraderTraitor was responsible for the attack. Law enforcement observed members of the unit converting stolen assets into the cryptocurrency ether, the FBI said in a statement, adding that it expected further laundering of the assets through related technology. Pyongyang has for years denied using state-linked cyber units for espionage, financial theft and revenue, and its mission in Geneva and embassy in China did not respond to requests for comment, according to Reuters.
Binance said it had covered $6 billion of the stolen cryptocurrencies by using company money to buy replacement tokens, and that it would bear the financial impact of the theft rather than passing it on to users. Withdrawals resumed in phases from early on Sunday, starting with 15 cryptoassets including bitcoin, ether, XRP and dogecoin, according to the exchange’s status page and posts by its co-chief executive, Richard Teng.
How the heist unfolded
The bulk of the theft unfolded in around 20 minutes beginning late on Thursday, October 29, according to US blockchain analysis firms TRM Labs and Chainalysis. The attack involved an estimated $6.36 billion in digital assets taken from Binance wallets across 10 blockchain networks, according to TRM Labs.
Binance said in a preliminary assessment that the breach might be linked to a compromised laptop belonging to a DevOps engineer — a technology specialist who helps maintain software systems. The company later reported additional breach points and said there was no evidence that wallet private keys were exposed, although it has not published a full technical account of the attack.
TRM Labs said that on the Ethereum network, the attacker used a wallet feature to direct Binance’s hot wallet to move assets under the attacker’s control. On other networks, the transfers appeared to be ordinarily signed transactions. TRM’s findings point to a compromise of the exchange’s transaction-signing infrastructure — in other words, attackers may have found a way to make the system approve transfers that appeared valid, rather than stealing a master key. Those technical findings remain under investigation, and Binance said it has conducted security reviews and worked with law enforcement and partners to recover funds.
The scale of the theft dwarfs previous crypto heists. Last year, attackers stole $2.9 billion worth of cryptocurrency across nearly 150 attacks, according to researchers at TRM Labs. The previous record for a single theft was the $1.5 billion Bybit hack in February 2025, which the FBI also blamed on TraderTraitor. At an estimated $6.3 billion, the Binance incident is more than four times that size, and analysts quoted by Reuters said it may be the biggest financial robbery ever.
The FBI attribution — and a note of caution from the White House
The FBI’s attribution followed conclusions by blockchain-analysis firms, but the bureau has not released a full explanation of its evidence. TRM Labs said its assessment draws on on-chain and off-chain intelligence and similarities to earlier North Korean-linked thefts. Chainalysis said stolen Binance funds were mixed with funds from another theft it attributed to North Korea.
The FBI said it is working alongside the US Secret Service and the Internal Revenue Service’s Criminal Investigation division to track the stolen assets. It has asked exchanges, node operators and other crypto businesses to block transactions linked to wallet addresses it associates with TraderTraitor, and warned that the haul might next be moved through decentralised-finance platforms and token-swapping services designed to obscure its origin.
US President Donald Trump, however, said on Saturday that the US was still not certain if North Korea was involved. "We don’t know if it’s North Korea — but if it is, we’ll talk to North Korea about it," Trump was quoted as saying. That caution is a reminder that public attributions in cyber cases are investigative findings, not court judgments identifying individual perpetrators, and that the full evidence has not been made public.
What Binance has done to cover the losses
Binance has repeatedly said it would bear the financial impact of the funds stolen. It said it had set aside around $6.34 billion of company funds internally to cover the losses, drawing on its $1 billion Secure Asset Fund for Users (SAFU) — a bitcoin reserve held to protect customers in the event of security breaches — as well as part of its Futures Insurance Fund and its corporate treasury.
The company said it had worked with industry partners to freeze some of the affected assets, with about $3 billion located as of Friday, according to Reuters.
Withdrawals were suspended on Friday after the hack, while the exchange investigated the breach. On Sunday, Binance said it had processed around $4.6 billion in withdrawals and $1 billion in deposits by 10:30 a.m. ET, according to CNN, as the first phase of resumption got under way. The remaining 5 percent of stolen tokens consists of assets that are less liquid and may take longer to source in the required amounts, Binance said.
Why the hack matters beyond Binance
The Binance hack matters for three reasons. First, its sheer size raises questions about how even the world’s largest exchange, with extensive security resources, can lose billions of dollars in minutes. Regulators in several countries are likely to ask what controls failed and what new safeguards should be required for exchanges that hold customer funds.
Second, the attribution to North Korea, if confirmed, would fit a long pattern. North Korean-linked hackers have been blamed for a series of large crypto thefts in recent years, and Chainalysis estimated that North Korean hackers stole $2.02 billion in crypto during 2025 alone. Western governments have long accused Pyongyang of using cyber theft to fund its weapons programmes, a charge North Korea denies.
Third, the incident tests confidence in the crypto system itself. Binance’s decision to cover the losses from its own funds — rather than asking users to share the cost — was designed to protect that confidence. The speed with which withdrawals resumed, and the volume processed on Sunday, suggests that many users were willing to keep using the platform. Whether that confidence holds will depend on what the investigation reveals about how the breach happened, and whether more of the stolen funds can be frozen before they are laundered.
What happens next
In the longer term, the hack is likely to accelerate calls for stronger regulation of crypto exchanges.
For now, the immediate crisis at Binance appears to be easing. Withdrawals are flowing again, most of the stolen value has been covered by the company, and investigators have a public attribution to pursue. But with billions still moving through the crypto system, and the full technical story yet to be published, the Binance hack is far from over.
Sources: Reuters; CNN; The Statesman; Inc.
