FBI ties $6.3 billion Binance theft to North Korea as the exchange restarts withdrawals after covering 90% of losses

On October 31 the FBI said North Korean hackers stole more than $6 billion in digital assets from Binance on or around October 29. The bureau calls the group "TraderTraitor." It issued the alert jointly with the Secret Service and IRS Criminal Investigation (CoinDesk, NBC News, Cointelegraph). Binance puts the impact at about $6.3 billion. Blockchain analytics firm TRM Labs counts $6.36 billion and calls it the largest hack in history. Cointelegraph reports that the theft was larger than the next ten largest hacks combined.

Binance has not published a root cause. According to The Hacker News, early findings pointed to a DevOps engineer's compromised laptop. That laptop gave the attacker access to a service container, and from there the attacker submitted unauthorized withdrawal transactions. Later investigation found further "points of breach." Binance says it has found no evidence that any private key leaked. The attacker compromised the signing infrastructure itself, without needing to steal a private key. The attacker controlled which transactions Binance's hot-wallet signer approved, so the exchange's own withdrawal system signed and sent funds to attacker addresses on Ethereum and nine other chains, mostly within about 20 minutes (The Block, Crypto Times). On Ethereum, the attacker used an EIP-7702 delegation (an Ethereum feature that lets an ordinary account run contract code) to turn a Binance hot wallet into a sweeper under its control. Analysts say the attacker had prepared 50 signed authorizations in advance and began preparing at least 36 hours before the theft.

Freezes recovered part of the loss. Tether froze about $1.57 billion and Circle more than $800 million, and Binance counts about $3 billion frozen by industry partners in total. Bitcoin Magazine puts the unrecovered amount at $3.3 billion. Binance says it has replaced 90% of the stolen assets from corporate funds, futures reserves and its Secure Asset Fund for Users (SAFU), and that user balances are intact. On-chain data showed 7,499 bitcoin leaving a SAFU wallet. Binance says withdrawals will resume in phases, and the first phase opens between 06:00 and 09:00 UTC on November 1 (Watcher Guru).

A screenshot on French-language Telegram channels shows an account called "PAULY" that allegedly predicted the date and hour of the attack on August 26. No investigator has connected the post to the theft, and no one has authenticated the screenshot.