01-11-2026
Binance has begun restoring customer withdrawals after a cyberattack in which hackers stole approximately $6.3 billion in cryptocurrency. The exchange suspended some services following Thursday’s attack while it investigated the breach and carried out security checks. On Sunday, it reopened withdrawals in stages, including for Bitcoin, Ether and some stablecoins, and cautioned that high demand could delay transactions. Customers whose withdrawals fail were advised to wait briefly and try again.
Binance said it had replaced about 95 percent of the affected assets and would absorb the financial impact of the stolen funds rather than pass the loss on to users. It said additional services would return after security checks were completed. The company is working with law enforcement and industry partners to trace and recover the assets, and said it would publish a detailed report when its investigation concludes.
The FBI said North Korea was responsible for the theft, identifying the activity as TraderTraitor, a name the agency uses to track the operation. Investigators said the attackers were converting the stolen cryptocurrency primarily into ether, and warned that they expected further laundering through decentralised finance platforms and instant cryptocurrency exchange services. The FBI has previously attributed a separate theft of about $1.5 billion from the Bybit exchange in February 2025 to the same actors.
Binance initially said a compromised employee laptop might have enabled the intrusion, but later reported that investigators had found additional points of breach. The article presents the restoration of services alongside an ongoing investigation into the scale and method of the attack, the attribution to North Korea, and efforts to trace the stolen funds.
Entities: Binance, Federal Bureau of Investigation (FBI), North Korea, TraderTraitor, Bybit • Tone: neutral • Sentiment: neutral • Intent: inform
01-11-2026
The FBI has attributed the theft of a record $6.3 billion in virtual assets from cryptocurrency exchange Binance to North Korea. The agency said North Korean actors were laundering the stolen assets, primarily by converting them into Ethereum, and warned that the funds are expected to be moved through further laundering stages. It identified the group TraderTraitor, which was also blamed for a $1.5 billion theft from the Bybit platform in February of the previous year. The FBI urged virtual-asset service providers to block transactions connected to the operation and supplied digital addresses to monitor.
Binance said it had replaced 90 percent of the stolen amount by using company funds to purchase new tokens. The remaining portion consists of less liquid tokens that could take longer to reacquire. The company said it would keep buying the relevant assets until it had replaced the full covered amount, and that it—not its users—would bear the financial impact. Funding came from Binance’s $1 billion Secure Asset Fund for Users, its Futures Insurance Fund, and corporate treasury.
The incident unsettled markets: cryptocurrency prices fell on Friday as Binance sought to reassure customers. Co-CEO Richard Teng described the breach as a complex attack involving a compromised laptop and malware designed to erase evidence, complicating investigation and tracing. Binance temporarily halted customer withdrawals after the hack, then said it expected to reopen them on Sunday. It also published a new proof-of-reserves snapshot intended to let users verify that customer assets were backed at a minimum one-to-one ratio.
Entities: Federal Bureau of Investigation (FBI), North Korea, Binance, TraderTraitor, Bybit • Tone: analytical • Sentiment: negative • Intent: inform
01-11-2026
Binance says it has covered 90% of the cryptocurrency assets worth $6.3bn stolen in a Thursday hack and has set aside more than $6.34bn of company funds to compensate users in full. The exchange said the remaining 10% may take longer to obtain in the required amounts, but pledged that users would not bear the financial loss. Withdrawals had been suspended after the attack; Binance said on Sunday that they had resumed on several networks, with other withdrawals expected to return in phases. The company said it replenished the stolen assets using a range of funds, including its corporate treasury, and that bitcoin, Ethereum, Tether and seven other widely traded cryptocurrencies are covered. Binance also said it froze about $3bn of stolen assets with help from law enforcement and private-sector partners, while its investigation continues.
The FBI attributed the attack to North Korea and said it had observed hackers converting stolen assets into Ethereum, with further conversions through decentralised finance and instant-swap services expected. Two analytics firms had previously told the BBC that intelligence pointed to the North Korean state-backed Lazarus Group, also known as TraderTraitor. US President Donald Trump said the US was still establishing who was responsible and had not confirmed North Korea's involvement. North Korea denies involvement in such attacks.
Binance's initial investigation indicated that an engineer's laptop had been compromised, enabling unauthorised withdrawals. A later update identified additional points of breach. Co-chief executive Richard Teng said multiple people carried out the attack and used sophisticated methods, including a “self-destruct mechanism,” to conceal their tracks. If confirmed, the $6.3bn theft would be the largest crypto hack on record, surpassing the $1.5bn Bybit exchange heist in 2025, which the FBI also blamed on North Korea. The US Secret Service said it was working with private-sector partners to trace, freeze and recover the funds.
Entities: Binance, Richard Teng, Donald Trump, Federal Bureau of Investigation (FBI), US Secret Service • Tone: analytical • Sentiment: neutral • Intent: inform
01-11-2026
Blockchain intelligence firms and the FBI say North Korea-linked hacking group TraderTraitor was likely responsible for an attack that stole approximately $6.36 billion from Binance, the world’s largest cryptocurrency exchange. TRM Labs said the funds were moved from Binance wallets across ten blockchains, mostly within about 20 minutes, making the theft the largest cryptocurrency heist on record. The FBI said the hackers were converting the stolen assets into Ethereum in preparation for further laundering. Binance reported that deposits were unaffected, temporarily suspended withdrawals, and said it would cover customer losses. It also worked with blockchain partners to freeze roughly $3 billion in affected assets. The company’s initial investigation suggested a compromised laptop, while a later probe found additional possible points of breach. Binance said it had found no evidence that wallet private keys were leaked and promised further technical details after its investigation. TRM Labs and Chainalysis CEO Jonathan Levin connected the incident to TraderTraitor and earlier North Korean-linked attacks, including the 2025 Bybit hack, which the FBI said caused $1.5 billion in losses. TraderTraitor is believed to be part of the broader Lazarus Group, which has been linked to attacks across government, finance, and other sectors. The article describes cryptocurrency theft as a source of foreign currency for North Korea amid sanctions and economic hardship, potentially helping fund its nuclear program. Former Binance CEO Changpeng Zhao said customer funds were safe and expected the company to cover losses. Cybersecurity executive Kok Tin Gan raised concerns about Binance’s approval controls, suggesting a single signature may have granted an attacker extensive access to a hot wallet. Binance disputed evidence of a private-key leak, while its investigation continued.
Entities: Binance, TraderTraitor, Lazarus Group, TRM Labs, Federal Bureau of Investigation (FBI) • Tone: analytical • Sentiment: negative • Intent: inform
01-11-2026
Binance resumed cryptocurrency withdrawals in stages after a record theft of about $6.3 billion in token assets from its hot wallets. The exchange initially reopened the Bitcoin network, then restored withdrawals through the Ethereum Network and BNB Smart Chain. Binance had said it restored backing for about 90% of the affected assets, while emphasizing that this figure reflects replacement of the assets—not recovery of 90% of the stolen funds from the attacker.
Binance said it would buy remaining tokens through market and over-the-counter channels until all relevant assets were fully covered. It reported that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were already 100% backed. The remaining shortfall involved less-liquid tokens outside the top 10, which could take longer to source. To replenish assets, the company said it was drawing on its Secure Asset Fund for Users, part of its Futures insurance fund, and its corporate treasury, and that users would not bear the financial impact.
The FBI said North Korea was responsible for the theft and that malicious actors had laundered stolen assets by converting them into Ethereum, with further laundering expected. Blockchain intelligence firm TRM Labs cited similarities to earlier North Korea-linked attacks, including the Bybit and KelpDAO hacks. The precise method of the Binance attack remains unclear. Binance’s initial explanation pointed to a possibly compromised DevOps engineer’s laptop, but Co-CEO Richard Teng later described a more complex process than misuse of one engineer’s permissions. Binance said it would continue investigating and make progress reports, while withdrawal services remained subject to security checks.
Entities: Binance, North Korea, Federal Bureau of Investigation (FBI), TRM Labs, Richard Teng • Tone: analytical • Sentiment: negative • Intent: inform
01-11-2026
The FBI says North Korea was responsible for stealing more than $6 billion in virtual assets from Binance, the world’s largest cryptocurrency exchange by daily trading volume. The agency said the theft occurred on or around October 29, 2026, and linked it to “TraderTraitor,” a group it associates with a $1.5 billion hack of Bybit the previous year. The theft reportedly took place within minutes and is believed to be the largest cryptocurrency heist in history.
The stolen assets included bitcoin, ethereum, and stablecoins such as tether and USD Coin. The attack prompted a fall in the prices of many major cryptocurrencies. Binance suspended withdrawals after the incident, then began restoring them in phases on Sunday, starting with 15 cryptocurrencies, including bitcoin, ether, XRP, and dogecoin.
The FBI said it had observed the suspected actors converting stolen assets, mainly into ethereum. It warned that the funds could be further laundered through decentralized-finance and instant-swap services, and asked cryptocurrency exchanges, blockchain analytics firms, and others to block transactions associated with identified addresses.
Binance said it was using company funds exceeding $6.34 billion to buy tokens and replenish about 90% of the stolen assets. It said the remaining 10% involved less-liquid tokens that could take longer to repurchase, and pledged to cover the full financial impact of the theft. The article also notes broader concerns that increasingly capable artificial-intelligence models could undermine cryptography and information-technology security protocols.
Entities: Federal Bureau of Investigation (FBI), North Korea (Democratic People's Republic of Korea), Binance, TraderTraitor, Bybit • Tone: analytical • Sentiment: negative • Intent: inform
01-11-2026
The FBI has attributed a theft of more than $6 billion in digital assets from Binance to North Korea, identifying the activity as part of the TraderTraitor campaign. The agency said the theft occurred around October 29, 2026, and reported that it had observed the attackers converting stolen assets into Ethereum. The FBI expects the funds to be further laundered through decentralised finance (DeFi) and instant-swap services.
Binance co-CEO Richard Teng described the incident as a “complex attack” in which hackers accessed the exchange’s hot wallets. Following the breach, Binance temporarily suspended deposits and withdrawals while it conducted security checks, froze funds, and worked with law enforcement to investigate. The exchange said it had covered around 90% of the amount affected and was restoring withdrawals in phases. It added that the remaining tokens were less liquid and could take longer to purchase. Teng said Binance would cover all hacked losses using company funds and reassured users that their assets were safe.
The article places the allegation in the context of prior North Korean cyber activity. The US Cybersecurity and Infrastructure Security Agency (CISA) says TraderTraitor has been associated with cryptocurrency theft and cyberattack tactics since at least 2020. The group is believed to be connected to the Lazarus Group, which CISA says has targeted blockchain and cryptocurrency businesses using spearphishing and malware. The article reports the FBI’s accusation and Binance’s response; it does not independently establish responsibility for the attack.
Entities: Federal Bureau of Investigation (FBI), North Korea (Democratic People’s Republic of Korea), Binance, Richard Teng, Cybersecurity and Infrastructure Security Agency (CISA) • Tone: analytical • Sentiment: neutral • Intent: inform
01-11-2026
Binance said it had resumed cryptocurrency withdrawals on Sunday after suspending them following a major hack that stole more than $6 billion in digital assets. The exchange announced that the first phase of restored withdrawals would begin with the Bitcoin network, and said access would return gradually. Binance said it was prioritizing tokens according to recent user demand and would reopen each network and asset pair only after stability and security checks. The company said it had set aside more than $6.34 billion of its own funds to cover the losses, and that users would not bear the financial impact. It described the stolen amount as $6.3 billion, making the incident the largest crypto heist on record.
The FBI attributed the October 29 theft to North Korea, saying the Pyongyang-linked hacking group TraderTraitor was responsible. The bureau reported that the actors were converting stolen assets into Ethereum and warned that they might launder them further through decentralized finance platforms and instant-swap services. It urged private-sector firms to block transactions connected to addresses used by the group.
US President Donald Trump said he did not know whether North Korea was responsible, despite the FBI’s public attribution. The article places the attack among a series of high-profile cyber thefts linked to North Korea, whose hacking operations are believed to generate funds that help finance its weapons program. News of the hack also coincided with a sharp fall in the prices of most major cryptocurrencies on Friday. The report notes that the FBI’s conclusion confirmed suspicions previously raised by private investigators and analysts, while also presenting Trump’s expressed uncertainty.
Entities: Binance, Federal Bureau of Investigation (FBI), North Korea, TraderTraitor, Donald Trump • Tone: analytical • Sentiment: neutral • Intent: inform
01-11-2026
The article describes TraderTraitor, a North Korean hacking operation linked to the broader Lazarus Group, which US authorities blame for a reported US$6 billion theft from Binance on Oct 29. It presents the incident as the latest and largest in a series of cyberattacks attributed to North Korean actors, whose operations are believed to help finance the country’s weapons programme.
TraderTraitor hackers are said to use social engineering, including fake recruitment offers, to persuade targets to download malware. The article recounts a 2024 attack on DMM Bitcoin: a hacker posing as a recruiter contacted an employee of a wallet software company on LinkedIn and sent a supposed pre-employment test containing malicious code. The compromised employee’s identity was then used to gain access to systems.
The article places the group within North Korea’s broader cyber capabilities, which South Korean intelligence estimated included about 8,400 personnel in 2024. It also notes the Lazarus Group’s 2014 Sony Pictures hack, the 2016 theft from Bangladesh’s central bank, the 2017 WannaCry ransomware attack, and cryptocurrency thefts from the Ronin network, Atomic Wallet, Alphapo, CoinsPaid and Bybit. The Bybit theft, blamed on TraderTraitor in February 2025, involved about US$1.5 billion.
According to a professor quoted in the article, stolen cryptocurrency is laundered through mixing services or private exchanges and converted into funds for military research, weapons-component procurement and the defence industry. A 2024 United Nations report said proceeds from North Korean cyberattacks reportedly helped fund weapons of mass destruction development. Analysts say cyber theft is attractive to Pyongyang because sanctions constrain conventional foreign-currency earnings, while digital assets can be stolen quickly, with relatively few resources, and moved outside conventional banking channels.
Entities: TraderTraitor, Lazarus Group, North Korea, Binance, Pyongyang’s Reconnaissance General Bureau • Tone: analytical • Sentiment: negative • Intent: inform
01-11-2026
The FBI has attributed the theft of more than US$6 billion in cryptocurrency from Binance to North Korea, describing a cyberattack that experts consider the largest hack in cryptocurrency history and one of the biggest cyber incidents overall. In an Oct 31 statement, the FBI said North Korean “TraderTraitor” actors were converting the stolen assets primarily into Ethereum. Authorities expect the funds to be further laundered through decentralised finance (DeFi) and instant-swap services, making them harder to trace and recover.
Binance has said it has covered about 90 per cent of the reported US$6.3 billion loss and plans to restore withdrawals by Nov 1. The exchange reiterated that it would absorb the full impact of the theft so customers would not lose money. The breach has unsettled the cryptocurrency industry as it seeks wider mainstream adoption.
The article places the attack in the context of previous allegations against North Korean hackers, who have been linked by the FBI and cybersecurity experts to major cryptocurrency thefts. These include the US$1.5 billion Bybit attack in 2025 and a 2022 theft of about US$620 million. The FBI previously identified TraderTraitor as an elite North Korean hacking unit and blamed it for the Bybit incident.
US President Donald Trump said the United States was investigating North Korea’s possible involvement. He commented on the risks of cryptocurrency theft, contrasting it with the familiar process of taking money out by cheque. The article also notes that Trump has recently raised the possibility of meeting North Korean leader Kim Jong Un in 2026, although he had earlier said he was unsure anyone was seeking such a meeting.
Entities: Federal Bureau of Investigation (FBI), North Korea, Binance, TraderTraitor, Ethereum • Tone: analytical • Sentiment: negative • Intent: inform
01-11-2026
Binance has begun restoring customer withdrawals after a hack that stole $6.3bn in virtual assets, described in the article as the largest heist in history. The exchange initially froze withdrawals while investigating the breach, then announced a phased reopening on Sunday. Customers could first withdraw certain assets—including ethereum, USDT and USDC on the ethereum blockchain, and some assets on the BNB Smart Chain—before trading in Dogecoin and Avalanche resumed on their respective platforms. Binance says it has replenished 90% of the stolen amount, while co-chief executive Richard Teng pledged that the company would cover the remaining 10% so customers would not bear the loss. The company said it had allocated about $6.34bn to cover the incident, drawing on its secure asset fund for users, a bitcoin reserve, its futures insurance fund and corporate treasury.
The FBI confirmed that a North Korean state-affiliated group called TraderTraitor was responsible for the theft. The group is believed to be linked to Lazarus Group, previously accused of hacking Sony Pictures in 2014. The FBI said it had observed the hackers converting stolen assets into ethereum and warned that they were likely to launder funds through decentralised finance and instant-swap services. It urged private-sector organizations to block transactions connected to addresses used by the group.
Teng described the breach as a complex attack involving a compromised laptop and malicious software intended to erase evidence. The hack also unsettled cryptocurrency markets: bitcoin fell nearly 5%, ethereum nearly 6% and Binance’s BNB token nearly 10%. The incident has renewed concerns about North Korea’s ability to generate illicit revenue despite international sanctions, and comes amid broader worries about whether advances in artificial intelligence could weaken cryptography and IT security.
Entities: Binance, Richard Teng, Federal Bureau of Investigation (FBI), TraderTraitor, Lazarus Group • Tone: analytical • Sentiment: neutral • Intent: inform
01-11-2026
Binance, the world’s largest cryptocurrency exchange, said it would begin restoring withdrawals in phases after covering 95 per cent of the $6.3 billion in tokens stolen in a major cyberattack. The first phase was scheduled to start between 6am and 9am GMT on Sunday and include Bitcoin, ether, BNB, Solana, XRP, dogecoin and other digital assets. The remaining 5 per cent consists of less liquid tokens that Binance said could take longer to obtain in the required quantities.
The exchange temporarily suspended withdrawals as a precaution while it contained the incident’s impact, assessed affected services and conducted security checks. Binance said deposits remained open and unaffected. It said it would absorb the financial impact of the stolen funds rather than pass losses to customers, and reiterated that user funds were safe. Withdrawals would resume progressively as security and readiness checks were completed.
The FBI attributed the attack to TraderTraitor, a North Korean state-sponsored hacking unit. The agency said members of the group had converted stolen assets into ether and that it expected further laundering through related technology.
The report places the incident in the context of recurring security and governance failures in the cryptocurrency industry. It recalls the 2014 collapse of Mt Gox after large-scale Bitcoin thefts and other technical and operational failures, and the 2022 collapse of FTX amid fraud and misuse of customer funds. FTX founder Sam Bankman-Fried was later sentenced to prison. The article also notes the FBI’s attribution of a separate $1.5 billion theft from Bybit to North Korea, underscoring ongoing security threats to digital-asset platforms.
Entities: Binance, Shweta Jain, TraderTraitor, Federal Bureau of Investigation (FBI), North Korea • Tone: analytical • Sentiment: neutral • Intent: inform
