Binance said Sunday it had replenished about 95% of its estimated $6.3 billion loss after the FBI attributed the theft to North Korea, following a disruption to withdrawals at the exchange.
The FBI attributed the theft of more than $6 billion in virtual assets to North Korea and called the malicious cyber activity TraderTraitor. Binance said its hot wallets were compromised at about 4:05 p.m. ET (20:05 UTC) Thursday, Oct. 29, and valued the impact at approximately $6.3 billion.
Binance said investigators had identified more possible points of entry but were still piecing together how the attack unfolded, extending the exchange’s wider breach probe.
Binance’s Nov. 1 update raised its recovery figure from 90% the previous day. The exchange said the residual portion consisted of lower-liquidity tokens beyond its 10 listed assets. Binance named its Futures Insurance Fund and corporate treasury as recovery resources and said users would not bear the loss. Its Oct. 31 update said a partial draw from the Secure Asset Fund for Users (SAFU) was expected within 24 hours; the latest notice did not confirm that the draw was completed.
The FBI said monitoring with partner agencies showed most stolen funds being swapped for ETH. It urged virtual-asset firms to block transfers tied to addresses in its alert and warned that laundering could continue through decentralized finance (DeFi) platforms and instant-swap services.
Binance scheduled the first withdrawal window for 1-4 a.m. ET (06:00-09:00 UTC) Sunday, Nov. 1, with deposits still open. The Guardian reported Sunday that some withdrawals had resumed.
In February 2025, the FBI attributed a separate theft of about $1.5 billion from Bybit to North Korea and associated it with TraderTraitor. Binance’s Oct. 31 update said a complete zero-knowledge proof of reserves was expected by Nov. 3 UTC.
