# FBI ties $6.3 billion Binance theft to North Korea as the exchange restarts withdrawals after covering 90% of losses

The attackers made Binance's own hot-wallet signing system send funds on ten chains in about 20 minutes, and stablecoin issuers and partners froze roughly $3 billion of the proceeds.

- Published: 2026-11-01T05:46:52.612Z
- Canonical: https://polylog.news/crypto/2026-11-01/fbi-ties-6-3-billion-binance-theft-to-north-korea-as-the-exc
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CoinDesk](https://www.coindesk.com/policy/2026/10/31/fbi-confirms-north-korea-s-role-in-usd6-billion-binance-hack-asks-defi-community-to-block-btc-eth-sol-addresses), [CoinDesk](https://www.coindesk.com/business/2026/10/31/binance-says-it-has-replaced-90-of-stolen-crypto-after-massive-usd6-3-billion-breach), [Polylog editors](https://polylog.news), [Bitcoin Magazine](https://bitcoinmagazine.com/videos/what-to-know-about-the-6-3-billion-binance-hack), [The Block](https://www.theblock.co/news/business/2026-10-30-binance-hack-largest-crypto-hack-north-korea-432225), [The Hacker News](https://thehackernews.com/2026/10/binance-suffers-security-breach.html), [TRM Labs](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history)

On October 31 the FBI said North Korean hackers stole more than $6 billion in digital assets from Binance on or around October 29. The bureau calls the group "TraderTraitor." It issued the alert jointly with the Secret Service and IRS Criminal Investigation ([CoinDesk](https://www.coindesk.com/policy/2026/10/31/fbi-confirms-north-korea-s-role-in-usd6-billion-binance-hack-asks-defi-community-to-block-btc-eth-sol-addresses), [NBC News](https://www.nbcnews.com/business/business-news/fbi-says-north-korea-was-6-billion-binance-crypto-hack-rcna606758), [Cointelegraph](https://t.me/cointelegraph/72981)). Binance puts the impact at about $6.3 billion. Blockchain analytics firm TRM Labs counts $6.36 billion and calls it [the largest hack in history](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history). Cointelegraph reports that the theft [was larger than the next ten largest hacks combined](https://t.me/cointelegraph/72980).

Binance has not published a root cause. According to [The Hacker News](https://thehackernews.com/2026/10/binance-suffers-security-breach.html), early findings pointed to a DevOps engineer's compromised laptop. That laptop gave the attacker access to a service container, and from there the attacker submitted unauthorized withdrawal transactions. Later investigation found further "points of breach." Binance says it has found no evidence that any private key leaked. The attacker compromised the signing infrastructure itself, without needing to steal a private key. The attacker controlled which transactions Binance's hot-wallet signer approved, so the exchange's own withdrawal system signed and sent funds to attacker addresses on Ethereum and nine other chains, mostly within about 20 minutes ([The Block](https://www.theblock.co/news/business/2026-10-30-binance-hack-largest-crypto-hack-north-korea-432225), [Crypto Times](https://www.cryptotimes.io/insights/binance-hack-explained/)). On Ethereum, the attacker used an EIP-7702 delegation (an Ethereum feature that lets an ordinary account run contract code) to turn a Binance hot wallet into a sweeper under its control. Analysts say the attacker had prepared 50 signed authorizations in advance and began preparing at least 36 hours before the theft.

Freezes recovered part of the loss. [Tether froze about $1.57 billion and Circle more than $800 million](https://cryptodnes.bg/en/inside-binances-war-chest-how-a-6-3b-hack-gets-absorbed-without-touching-user-balances/), and Binance counts about $3 billion frozen by industry partners in total. [Bitcoin Magazine](https://bitcoinmagazine.com/videos/what-to-know-about-the-6-3-billion-binance-hack) puts the unrecovered amount at $3.3 billion. Binance says it has [replaced 90% of the stolen assets](https://www.coindesk.com/business/2026/10/31/binance-says-it-has-replaced-90-of-stolen-crypto-after-massive-usd6-3-billion-breach) from corporate funds, futures reserves and its Secure Asset Fund for Users (SAFU), and that user balances are intact. On-chain data showed [7,499 bitcoin leaving a SAFU wallet](https://fxdailyreport.com/binance-replenishes-90-stolen-assets-withdrawals-resume-nov-1st/). Binance says withdrawals will resume in phases, and the [first phase opens between 06:00 and 09:00 UTC](https://t.me/BWEnews/16597) on November 1 ([Watcher Guru](https://t.me/WatcherGuru/15744)).

A screenshot on French-language Telegram channels shows an account called "PAULY" that allegedly [predicted the date and hour of the attack on August 26](https://t.me/GokuCryptoNews/21167). No investigator has connected the post to the theft, and no one has authenticated the screenshot.

## What this means

The loss falls on Binance's own balance sheet rather than on depositor accounts. The main remaining exposure is to confidence in custodial exchanges and to the operational systems around their keys. Binance's keys appear intact, but its signer approved whatever the attacker submitted, so an audit of key storage or multi-party computation alone would not have caught this. The precedent is Bybit in February 2025. TraderTraitor stole about $1.5 billion there, Bybit covered the gap and stayed open, and the attackers laundered most of the unfrozen funds through cross-chain swaps within weeks. Markets have already priced Binance's ability to pay. The new information is that freezes by stablecoin issuers recovered close to half of the stolen funds, which makes centrally controlled stablecoins the most effective recovery tool in a large theft. The likelier outcome is that withdrawals proceed with elevated but orderly outflows over the coming weeks, and pressure builds over months for proof-of-reserves and operational audits that cover signing services and engineer access. This read depends on the phased withdrawals running on schedule. A delayed phase or a disclosed shortfall in the remaining 10% would prove it wrong.

## What to watch

- Whether Binance's later withdrawal phases open on time, and how large net outflows are once all assets are available. A stall would show that the 90% replacement figure does not match liquid reserves.
- Whether Binance publishes a full root-cause report that names the systems the DevOps compromise reached, because other exchanges with similar signing designs will judge their own exposure from it.
- How much of the roughly $3.3 billion in unfrozen funds moves into bitcoin or through cross-chain swap services, since that is where recovery stops being possible.