FBI Blames North Korea for $6B Binance Hack as Exchange Reopens Withdrawals

The FBI has officially attributed last week's theft of more than $6 billion from cryptocurrency exchange Binance to North Korean hackers operating under the name 'TraderTraitor.' The bureau confirmed the attribution made earlier by blockchain analytics firms TRM Labs and Chainalysis, revealing that the hackers converted stolen assets mainly into Ethereum and are expected to launder the funds through decentralized finance (DeFi) services and instant swaps.

In an alert published on Saturday, the FBI urged crypto businesses to block transactions involving hundreds of Ethereum addresses, 19 Bitcoin addresses and one Solana address linked to the theft. The Secret Service, which is also investigating, confirmed that its investigators worked with industry partners to freeze 'a significant portion' of the stolen crypto within minutes of the attack.

Withdrawals Resume

Binance began restoring withdrawals in phases at 1 a.m. ET on Sunday, processing $4.649 billion in withdrawals and $1.01 billion in deposits in the first nine and a half hours. This represented a net outflow of about $3.64 billion, or 2.1% of Binance's $171 billion in assets as of October 28.

CEO Richard Teng stated that Binance had replenished approximately 95% of the affected assets, assuring customers that the exchange would cover the losses. By Monday, Binance had reopened withdrawals on additional networks including Zcash, TON and Sui, and restored fiat withdrawals in several currencies including U.S. dollars.

Money Trail

The laundering of stolen funds is already well underway, according to Chainalysis. After the attack, hackers moved more than $500 million on Tron through over 1,000 addresses and several Tron-based DeFi protocols. Most of those staging wallets have now been drained, with funds moving to Ethereum, Bitcoin and other chains via cross-chain services.

Binance reported raising $6 billion to cover the losses from its corporate treasury, insurance fund and SAFU emergency fund. Circle froze more than $1.1 billion in USDC related to the hack. Data from DefiLlama showed Binance's total assets at about $127.6 billion on Monday, with more than $6 billion leaving wallets associated with the exchange over 24 hours after withdrawals reopened.

Market Impact

The hack has rattled institutional investors, with spot Bitcoin ETFs shedding $643.2 million on Friday, the first full trading session after the breach. This left the funds with roughly $516 million in net outflows for October. Rival exchanges OKX and Bybit recorded net inflows of about $450 million and $134 million respectively during Binance's reopening.

As Binance continues to stabilize, the exchange has taken a new reserves snapshot on October 31 and expects to publish an updated report on Monday. The incident highlights ongoing security challenges in the cryptocurrency industry as digital assets become increasingly valuable targets for sophisticated criminal organizations.