The FBI has attributed the theft of approximately $6.3 billion from Binance, the world's largest cryptocurrency exchange, to North Korea. In a statement issued on 31 October, the bureau identified the activity as TraderTraitor and said the theft occurred on or about 29 October.
Binance's initial investigation suggested that a compromised engineer's laptop might have provided an entry point, although subsequent checks uncovered additional breaches. The exchange described the incident as a complex attack. Working with the US Secret Service and tax agency criminal investigators, the FBI observed stolen assets being converted primarily into ether and urged cryptocurrency businesses to block transactions linked to the attackers.
After temporarily suspending deposits and withdrawals for security checks, Binance began restoring withdrawals in phases on 1 November. The initial phase prioritised networks and assets with the strongest user demand over the preceding week, while deposits remained open. Further withdrawals would follow as security checks were completed.
The exchange said it had covered about 95% of the stolen amount, with the remaining 5% comprising less liquid tokens that were harder to acquire in sufficient quantities. It was buying these through market transactions and over-the-counter deals. Binance pledged to absorb the entire financial loss rather than transfer it to users.
More than $6.34 billion was allocated from company resources, including its emergency user-protection reserve, futures insurance fund and corporate treasury. Binance also planned to replenish the emergency reserve to about $1 billion. It expected to publish proof of its reserves by 3 November, allowing holders of its ten main tokens to verify that their holdings were fully backed.
