Binance Recovers 95% of $6.43B Stolen by TraderTraitor Group

Binance covers 95% of stolen funds using internal reserves

Binance announced it has covered 95% of the stolen funds to protect its users.

The remaining 5% of the stolen amount consists of less liquid tokens that take longer to source.

Net outflows reach $3.64 billion as withdrawals resume

UTC on November 1. This activity followed the resumption of withdrawal services after the incident.

Withdrawal services restored across 15 networks

Binance began restoring withdrawal services in phases starting at 6 a.m. UTC on Sunday. Phase one of withdrawals operated between 06:00 and 09:00 UTC.

Services across all 15 networks were fully resumed by 12:36 p.m. UTC. The exchange performed security assessments and verified service readiness while implementing precautionary measures.

Deposit services remained open throughout the incident and were not affected by the pause.

FBI tracks $2.85 billion in frozen stolen assets

The FBI, U.S. Secret Service, and IRS Criminal Investigation reported that attackers moved stolen funds across 11 blockchains. Approximately 82% of the value resides on the Ethereum and Bitcoin networks.

Authorities observed malicious actors converting assets primarily into Ethereum to facilitate laundering. The FBI expects further laundering through decentralized finance and instant swap services.

The agency released a list of wallet addresses allegedly used by the attackers. Tether, Circle, Ripple, Arbitrum, and Optimism have frozen $2.85 billion of the $6.43 billion stolen on-chain.

TraderTraitor group tactics involve malware and job-themed lures

TraderTraitor has been active since at least 2020 and uses malware-laden applications to trick victims. Reports from SentinelOne, Zscaler ThreatLabz, and Microsoft show the group uses trojanised Terraform providers as a malware distribution vector. The group also uses front companies to target individuals in cybersecurity, AI, blockchain, and recruitment.

The compromised Terraform provider delivers a Bash loader that downloads OS-specific malware, including a cross-platform implant called FLATROOF. This implant uses a Python-based information stealer before dropping the ROOFDECK backdoor to gain full remote control.

These campaigns use recruitment-themed lures and AI-generated personas to convince victims to run malicious code.

The group used these methods to offer software-engineer-themed opportunities to initiate contact.

North Korean regime linked to $6.5 billion in total crypto thefts

Elliptic estimates that the North Korean regime has stolen over $6.5 billion in crypto-assets in recent years. The $6.43 billion Binance theft nearly doubles the total stolen by the regime, according to Elliptic.

This haul exceeds the $1.46 billion stolen from Bybit in February 2025, which was previously the largest cryptocurrency theft in history. The FBI previously linked the TraderTraitor group to a $1.5 billion hack of Bybit last year.

Founder Changpeng Zhao claims 98% of users remain

Binance founder and former CEO Changpeng Zhao stated on X that 98% of users choose to stay following the breach. Zhao remarked that trust is not earned by what is said in good times, but by what is done in hard times.