The FBI blames North Korea for the theft of more than $6 billion in cryptocurrency from Binance on October 29. This October 31 announcement comes as the platform claims to have replaced 90% of the affected assets with its own resources and protection funds.
The FBI wants to block the circulation of loot
in your official noticeThe US federal police designate the actors they track as TraderTraitor. Work with the Secret Service and IRS tax investigators to track the transactions. The funds were mainly converted into ether; Authorities expect more movements through exchange services and decentralized financial protocols. Therefore, the alert is also directed at intermediaries capable of complicating these transfers. The FBI asks them to block transactions linked to identified addresses or funds originating from them. It publishes a list of addresses to help platforms, infrastructure operators and blockchain analysis specialists recognize suspicious transactions.
This official attribution follows the Binance hack revealed this week. In its first report, the company estimated the impact at about $6.3 billion and announced the freezing of about $3 billion. Replacing missing assets now requires another task: mobilizing enough assets to cover customer accounts.
Binance buys back missing cryptocurrencies
According to its October 31 update, Binance has set aside more than $6.34 billion for this operation. The company mobilizes its cash, part of the SAFU protection fund and part of the insurance fund from its futures contracts. It maintains its commitment to bear economic losses without users paying for them. The platform ensures that ten assets, including bitcoin, ether, BNB, and stablecoins USDT and USDC, are fully covered. It continues to purchase other tokens on the market and from over-the-counter counterparties. Its lower liquidity slows down the acquisition of the necessary quantities.
The next appointment remains for clients. reopening of withdrawalsannounced for Sunday, November 1. The October 31 press release still presents this deadline as a target, with no confirmation of resumption. Binance also announces a new photograph of its reserves, the full crypto verification of which will be published later.
The technical investigation traces back to a DevOps engineer’s compromised laptop. According to the initial Binance account, this access was used to reach a service container and then activate unauthorized withdrawals. The company indicated that it had found no evidence of a leak of the private keys to its wallets. He revoked authorizations linked to the affected addresses and suspended withdrawals during his intervention; deposits remained available.
TraderTraitor was already attacked after the Bybit robbery
The name chosen by the FBI refers to an important precedent. On February 26, 2025, the agency blamed North Korea for the theft of approximately $1.5 billion from Bybit, which occurred five days earlier. We mentioned this attack on the exchange platform, then we consider it a digital theft of exceptional magnitude.
In this case, researchers have already described rapid conversions to bitcoin and other currencies, and then dispersion among thousands of addresses spread across several blockchains. Their request for cooperation focused on the same links: exchange platforms, operators of decentralized services and companies capable of tracking movements. On Binance, the alert seeks to stop this circulation while the replenishment of reserves continues separately.
The FBI encourages persons with information about transfers related to this new attack to report it to its field offices or to its Internet Crime Reporting Center, accessible at IC3.gov.
