FBI Attributes $6.3 Billion Binance Hack to North Korean Group

Net outflows reach $4.72 billion following service resumption

Binance stated that this $4.72 billion figure represents approximately 2.8% to 3% of the total assets on its platform. The exchange noted that the majority of these withdrawals consisted of Tether’s USDT stablecoin.

Other data sources provided varying figures regarding the scale of capital movement following the breach. The Honolulu Star-Advertiser reported that clients pulled $4.7 billion after the hack.

Exchange replaces 95% of stolen assets

Binance has replaced 95 percent of the assets affected by the security breach. This figure represents an increase from the 90 percent replacement rate reported in an earlier update.

Binance has raised USD 6 billion through these mechanisms to address the deficit.

The remaining 5 percent of affected assets consist of less liquid tokens. Binance is currently purchasing these tokens through market and over-the-counter channels to complete the replenishment.

FBI identifies North Korean group as attacker

The FBI identified the North Korean state-sponsored hacking group known as TraderTraitor as the party responsible for the October 29 attack. TRM Labs reported that North Korea-linked hackers have stolen a total of USD 7.4 billion during 2026.

Binance discovered additional breach points beyond the initial compromise of an engineer's laptop. These findings indicate that the security failure involved more complex access points than the single laptop previously identified.

Industry partners freeze $3 billion in stolen funds

Industry partners have frozen approximately USD 3 billion in stolen assets as part of the ongoing investigation and recovery effort. This amount is distinct from the assets Binance used for its internal replacement program.

Tether has frozen approximately USD 1.57 billion in USDT. Secret Service to trace the stolen funds. Secret Service to trace the stolen funds.

Approximately USD 3.3 billion in stolen funds remain unfrozen. Investigators are currently tracking wallet activity across ten different blockchains to locate these assets.

Blockchain analytics firm Elliptic estimates that the hackers still control USD 3.28 billion in bitcoin and ether. Only a negligible amount of the stolen funds has been converted into fiat currency so far.

Market stabilization and user sentiment

Bitcoin prices dropped approximately 5% to fall below $77,000 following the security breach. Shares of Coinbase, Robinhood, Strategy, and Strive also experienced declines in value.

Bitcoin traded above $78,000 on Monday after recovering from a six-week low recorded on Friday. By Monday, prices recovered to trade above $77,000, according to Live.euronext.com.

Binance co-CEO Yi He stated on X on Monday that the company's top priority is to ensure the environment is secure so users can withdraw funds and operations can resume. On Sunday, the exchange recorded $1 billion in deposits against $4.6 billion in withdrawals.

Other exchanges also recorded inflows over a 24-hour period, including $284.87 million at OKX, $93.22 million at Gate, and $29.25 million at Bybit.

Spot bitcoin ETFs recorded $643 million in outflows on Friday, which was the largest single-day withdrawal for October.

Operational updates and proof-of-reserves

The exchange also resumed Bitcoin withdrawals via the Bitcoin network, as well as ether and dollar-backed stablecoin withdrawals via the Ethereum network.

Following this resumption, large XRP outflows from the exchange reached 80 million.

The exchange plans to release this new proof-of-reserves snapshot on November 4. The associated proof is expected to take between 40 and 50 hours to generate.