01-11-2026
Binance has begun restoring customer withdrawals after a cyberattack in which hackers stole approximately $6.3 billion in cryptocurrency. The exchange suspended some services following Thursday’s attack while it investigated the breach and carried out security checks. On Sunday, it reopened withdrawals in stages, including for Bitcoin, Ether and some stablecoins, and cautioned that high demand could delay transactions. Customers whose withdrawals fail were advised to wait briefly and try again.
Binance said it had replaced about 95 percent of the affected assets and would absorb the financial impact of the stolen funds rather than pass the loss on to users. It said additional services would return after security checks were completed. The company is working with law enforcement and industry partners to trace and recover the assets, and said it would publish a detailed report when its investigation concludes.
The FBI said North Korea was responsible for the theft, identifying the activity as TraderTraitor, a name the agency uses to track the operation. Investigators said the attackers were converting the stolen cryptocurrency primarily into ether, and warned that they expected further laundering through decentralised finance platforms and instant cryptocurrency exchange services. The FBI has previously attributed a separate theft of about $1.5 billion from the Bybit exchange in February 2025 to the same actors.
Binance initially said a compromised employee laptop might have enabled the intrusion, but later reported that investigators had found additional points of breach. The article presents the restoration of services alongside an ongoing investigation into the scale and method of the attack, the attribution to North Korea, and efforts to trace the stolen funds.
Entities: Binance, Federal Bureau of Investigation (FBI), North Korea, TraderTraitor, Bybit • Tone: neutral • Sentiment: neutral • Intent: inform
01-11-2026
The FBI has attributed the theft of a record $6.3 billion in virtual assets from cryptocurrency exchange Binance to North Korea. The agency said North Korean actors were laundering the stolen assets, primarily by converting them into Ethereum, and warned that the funds are expected to be moved through further laundering stages. It identified the group TraderTraitor, which was also blamed for a $1.5 billion theft from the Bybit platform in February of the previous year. The FBI urged virtual-asset service providers to block transactions connected to the operation and supplied digital addresses to monitor.
Binance said it had replaced 90 percent of the stolen amount by using company funds to purchase new tokens. The remaining portion consists of less liquid tokens that could take longer to reacquire. The company said it would keep buying the relevant assets until it had replaced the full covered amount, and that it—not its users—would bear the financial impact. Funding came from Binance’s $1 billion Secure Asset Fund for Users, its Futures Insurance Fund, and corporate treasury.
The incident unsettled markets: cryptocurrency prices fell on Friday as Binance sought to reassure customers. Co-CEO Richard Teng described the breach as a complex attack involving a compromised laptop and malware designed to erase evidence, complicating investigation and tracing. Binance temporarily halted customer withdrawals after the hack, then said it expected to reopen them on Sunday. It also published a new proof-of-reserves snapshot intended to let users verify that customer assets were backed at a minimum one-to-one ratio.
Entities: Federal Bureau of Investigation (FBI), North Korea, Binance, TraderTraitor, Bybit • Tone: analytical • Sentiment: negative • Intent: inform
01-11-2026
Binance says it has covered about 90% of the $6.3bn in cryptocurrency stolen in a hack on Thursday, and expects to cover the remaining 10%, although sourcing the assets in the required amounts may take longer. The company says it has set aside more than $6.34bn of its own funds and will absorb the loss rather than pass it on to users. It has also restored withdrawals on several networks after suspending them following the attack, with other withdrawals expected to resume in phases.
The FBI has attributed the attack to North Korea, saying it observed hackers converting the stolen assets into Ethereum before likely moving them through decentralised finance and instant-swap services. Two analytics firms previously told the BBC that evidence pointed to the North Korean state-backed Lazarus Group, also known as TraderTraitor, which the FBI named. US President Donald Trump said the US was still establishing who was responsible and that it would speak to North Korea if its involvement were confirmed. North Korea has denied responsibility for such attacks.
Binance said it replenished assets using multiple sources, including its corporate treasury. Its coverage includes bitcoin, Ethereum, Tether and seven other widely traded crypto assets. The company’s initial inquiry indicated that an engineer’s laptop may have been compromised, enabling unauthorised withdrawals, but later investigators identified additional breach points. Binance co-chief executive Richard Teng said multiple people were involved and described methods used to conceal their tracks, including a “self-destruct mechanism.”
The company said it froze around $3bn of stolen assets with help from law enforcement and other partners. The US Secret Service also said it was working with private-sector partners to identify, freeze, trace and recover the funds. The investigation remains ongoing. If confirmed as the largest crypto theft, the hack would surpass the $1.5bn Bybit exchange heist in 2025, which the FBI also blamed on North Korea.
Entities: Binance, Federal Bureau of Investigation (FBI), North Korea, Lazarus Group, TraderTraitor • Tone: neutral • Sentiment: neutral • Intent: inform
01-11-2026
Blockchain intelligence firms and the FBI say North Korea’s TraderTraitor hacking unit was likely responsible for a theft of approximately $6.3 billion from Binance, the world’s largest cryptocurrency exchange. TRM Labs said about $6.36 billion was moved from Binance wallets across ten blockchains, mostly within roughly 20 minutes, and called the incident the largest cryptocurrency theft on record. The FBI said the stolen funds were being converted into Ethereum in preparation for further laundering. Investigators cited similarities to earlier North Korea-linked attacks, including the 2025 Bybit hack, which the FBI said caused $1.5 billion in losses.
Binance said customer deposits were unaffected, but it suspended withdrawals, expecting to restore them within a day or two. The company and its blockchain partners froze roughly $3 billion in affected assets, and Binance pledged to cover customer losses. Its initial investigation pointed to a potentially compromised laptop; a later probe identified additional possible breach points. Binance said it had found no evidence that wallet private keys had leaked and promised further technical details after the investigation.
The incident has prompted questions about Binance’s security controls. NyxLab CEO Kok Tin Gan suggested that a single signature may have given the attacker lasting, full access to a hot wallet. Binance said its teams were working with law enforcement to identify those responsible. Former CEO and founder Changpeng Zhao said user funds were safe and expressed confidence that they would be covered, while acknowledging the theft appeared to be a hack.
The article places the attack within North Korea’s broader cyber activity. U.S. officials have linked the Lazarus Group, a wider hacking organization believed to include TraderTraitor members, to attacks across government, finance, and other sectors. Experts say cryptocurrency theft helps North Korea obtain foreign currency amid sanctions and economic hardship and may help fund its nuclear program. The article also notes Zhao’s 2023 felony plea related to anti-money-laundering failures, his departure as CEO, and his 2025 presidential pardon.
Entities: Binance, TraderTraitor, Lazarus Group, TRM Labs, Federal Bureau of Investigation (FBI) • Tone: analytical • Sentiment: negative • Intent: inform
01-11-2026
Binance resumed cryptocurrency withdrawals in stages after a record theft of about $6.3 billion in token assets from its hot wallets. The exchange initially reopened the Bitcoin network, then restored withdrawals through the Ethereum Network and BNB Smart Chain. Binance had said it restored backing for about 90% of the affected assets, while emphasizing that this figure reflects replacement of the assets—not recovery of 90% of the stolen funds from the attacker.
Binance said it would buy remaining tokens through market and over-the-counter channels until all relevant assets were fully covered. It reported that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were already 100% backed. The remaining shortfall involved less-liquid tokens outside the top 10, which could take longer to source. To replenish assets, the company said it was drawing on its Secure Asset Fund for Users, part of its Futures insurance fund, and its corporate treasury, and that users would not bear the financial impact.
The FBI said North Korea was responsible for the theft and that malicious actors had laundered stolen assets by converting them into Ethereum, with further laundering expected. Blockchain intelligence firm TRM Labs cited similarities to earlier North Korea-linked attacks, including the Bybit and KelpDAO hacks. The precise method of the Binance attack remains unclear. Binance’s initial explanation pointed to a possibly compromised DevOps engineer’s laptop, but Co-CEO Richard Teng later described a more complex process than misuse of one engineer’s permissions. Binance said it would continue investigating and make progress reports, while withdrawal services remained subject to security checks.
Entities: Binance, North Korea, Federal Bureau of Investigation (FBI), TRM Labs, Richard Teng • Tone: analytical • Sentiment: negative • Intent: inform
01-11-2026
The FBI says North Korea was responsible for stealing more than $6 billion in virtual assets from Binance, the world’s largest cryptocurrency exchange by daily trading volume. The agency said the theft occurred on or around October 29, 2026, and was carried out through malicious cyber activity linked to an entity known as TraderTraitor. The attack, completed within minutes, is believed to be the largest cryptocurrency heist in history. The stolen assets included bitcoin, ethereum and stablecoins such as tether and USD Coin. News of the attack contributed to a fall in prices for most major cryptocurrencies.
The FBI said TraderTraitor actors had been converting the stolen funds primarily into ethereum and warned that they were expected to use decentralized-finance and instant-swap services to launder the assets further. The agency asked cryptocurrency exchanges, blockchain analytics companies and others to block transactions connected to identified addresses, in an effort to prevent the funds from being laundered and obscure their origins. The FBI linked the group to a $1.5 billion Bybit hack the previous year.
Binance suspended withdrawals after the attack, then began restoring them in phases on Sunday. The first phase covered 15 cryptocurrencies, including bitcoin, ether, XRP and dogecoin. The company said it was using more than $6.34 billion in company funds to buy tokens and replenish about 90% of the stolen assets. The remaining 10% involved less-liquid tokens that could take longer to replace. Binance said it would fully cover the financial impact of the theft. The article also notes that the incident came amid growing concerns that increasingly capable artificial-intelligence models could threaten cryptography and IT security protocols.
Entities: Federal Bureau of Investigation (FBI), North Korea (Democratic People's Republic of Korea), Binance, TraderTraitor, Bybit • Tone: neutral • Sentiment: negative • Intent: inform
01-11-2026
The FBI has attributed a theft of more than $6 billion in digital assets from Binance to North Korea, identifying the activity as part of the TraderTraitor campaign. The agency said the theft occurred around October 29, 2026, and reported that it had observed the attackers converting stolen assets into Ethereum. The FBI expects the funds to be further laundered through decentralised finance (DeFi) and instant-swap services.
Binance co-CEO Richard Teng described the incident as a “complex attack” in which hackers accessed the exchange’s hot wallets. Following the breach, Binance temporarily suspended deposits and withdrawals while it conducted security checks, froze funds, and worked with law enforcement to investigate. The exchange said it had covered around 90% of the amount affected and was restoring withdrawals in phases. It added that the remaining tokens were less liquid and could take longer to purchase. Teng said Binance would cover all hacked losses using company funds and reassured users that their assets were safe.
The article places the allegation in the context of prior North Korean cyber activity. The US Cybersecurity and Infrastructure Security Agency (CISA) says TraderTraitor has been associated with cryptocurrency theft and cyberattack tactics since at least 2020. The group is believed to be connected to the Lazarus Group, which CISA says has targeted blockchain and cryptocurrency businesses using spearphishing and malware. The article reports the FBI’s accusation and Binance’s response; it does not independently establish responsibility for the attack.
Entities: Federal Bureau of Investigation (FBI), North Korea (Democratic People’s Republic of Korea), Binance, Richard Teng, Cybersecurity and Infrastructure Security Agency (CISA) • Tone: analytical • Sentiment: neutral • Intent: inform
01-11-2026
Binance said it had resumed cryptocurrency withdrawals on Sunday after suspending them following a major hack that stole more than $6 billion in digital assets. The exchange announced that the first phase of restored withdrawals would begin with the Bitcoin network, and said access would return gradually. Binance said it was prioritizing tokens according to recent user demand and would reopen each network and asset pair only after stability and security checks. The company said it had set aside more than $6.34 billion of its own funds to cover the losses, and that users would not bear the financial impact. It described the stolen amount as $6.3 billion, making the incident the largest crypto heist on record.
The FBI attributed the October 29 theft to North Korea, saying the Pyongyang-linked hacking group TraderTraitor was responsible. The bureau reported that the actors were converting stolen assets into Ethereum and warned that they might launder them further through decentralized finance platforms and instant-swap services. It urged private-sector firms to block transactions connected to addresses used by the group.
US President Donald Trump said he did not know whether North Korea was responsible, despite the FBI’s public attribution. The article places the attack among a series of high-profile cyber thefts linked to North Korea, whose hacking operations are believed to generate funds that help finance its weapons program. News of the hack also coincided with a sharp fall in the prices of most major cryptocurrencies on Friday. The report notes that the FBI’s conclusion confirmed suspicions previously raised by private investigators and analysts, while also presenting Trump’s expressed uncertainty.
Entities: Binance, Federal Bureau of Investigation (FBI), North Korea, TraderTraitor, Donald Trump • Tone: analytical • Sentiment: neutral • Intent: inform
01-11-2026
The article describes TraderTraitor, a North Korean hacking operation linked to the broader Lazarus Group, which US authorities blame for a reported US$6 billion theft from Binance on Oct 29. It presents the incident as the latest and largest in a series of cyberattacks attributed to North Korean actors, whose operations are believed to help finance the country’s weapons programme.
TraderTraitor hackers are said to use social engineering, including fake recruitment offers, to persuade targets to download malware. The article recounts a 2024 attack on DMM Bitcoin: a hacker posing as a recruiter contacted an employee of a wallet software company on LinkedIn and sent a supposed pre-employment test containing malicious code. The compromised employee’s identity was then used to gain access to systems.
The article places the group within North Korea’s broader cyber capabilities, which South Korean intelligence estimated included about 8,400 personnel in 2024. It also notes the Lazarus Group’s 2014 Sony Pictures hack, the 2016 theft from Bangladesh’s central bank, the 2017 WannaCry ransomware attack, and cryptocurrency thefts from the Ronin network, Atomic Wallet, Alphapo, CoinsPaid and Bybit. The Bybit theft, blamed on TraderTraitor in February 2025, involved about US$1.5 billion.
According to a professor quoted in the article, stolen cryptocurrency is laundered through mixing services or private exchanges and converted into funds for military research, weapons-component procurement and the defence industry. A 2024 United Nations report said proceeds from North Korean cyberattacks reportedly helped fund weapons of mass destruction development. Analysts say cyber theft is attractive to Pyongyang because sanctions constrain conventional foreign-currency earnings, while digital assets can be stolen quickly, with relatively few resources, and moved outside conventional banking channels.
Entities: TraderTraitor, Lazarus Group, North Korea, Binance, Pyongyang’s Reconnaissance General Bureau • Tone: analytical • Sentiment: negative • Intent: inform
01-11-2026
The FBI has attributed the theft of more than US$6 billion in cryptocurrency from Binance to North Korea, describing a cyberattack that experts consider the largest hack in cryptocurrency history and one of the biggest cyber incidents overall. In an Oct 31 statement, the FBI said North Korean “TraderTraitor” actors were converting the stolen assets primarily into Ethereum. Authorities expect the funds to be further laundered through decentralised finance (DeFi) and instant-swap services, making them harder to trace and recover.
Binance has said it has covered about 90 per cent of the reported US$6.3 billion loss and plans to restore withdrawals by Nov 1. The exchange reiterated that it would absorb the full impact of the theft so customers would not lose money. The breach has unsettled the cryptocurrency industry as it seeks wider mainstream adoption.
The article places the attack in the context of previous allegations against North Korean hackers, who have been linked by the FBI and cybersecurity experts to major cryptocurrency thefts. These include the US$1.5 billion Bybit attack in 2025 and a 2022 theft of about US$620 million. The FBI previously identified TraderTraitor as an elite North Korean hacking unit and blamed it for the Bybit incident.
US President Donald Trump said the United States was investigating North Korea’s possible involvement. He commented on the risks of cryptocurrency theft, contrasting it with the familiar process of taking money out by cheque. The article also notes that Trump has recently raised the possibility of meeting North Korean leader Kim Jong Un in 2026, although he had earlier said he was unsure anyone was seeking such a meeting.
Entities: Federal Bureau of Investigation (FBI), North Korea, Binance, TraderTraitor, Ethereum • Tone: analytical • Sentiment: negative • Intent: inform
01-11-2026
Binance has begun a phased reopening of customer withdrawals after a record $6.3bn theft, which the FBI attributes to North Korea-linked hacking group TraderTraitor. The exchange initially froze withdrawals while investigating the breach, which occurred on Thursday. In the first phase, customers can withdraw certain Ethereum-based tokens, including ether, USDT and USDC, as well as some assets on the BNB Smart Chain.
Binance says it has replenished 90% of the stolen amount and that customers will not bear the financial cost. Co-chief executive Richard Teng said the company would cover the remaining 10%, which Binance described as less liquid and therefore potentially slower to replace. The company says it has set aside about $6.34bn to cover the losses, drawing on its Secure Asset Fund for Users, its Futures Insurance Fund and corporate funds.
The FBI said TraderTraitor stole more than $6bn in virtual assets from Binance around October 29. It believes the group is part of the Lazarus Group, which has previously been accused of high-profile cyberattacks. The FBI observed the attackers converting stolen assets into ether and warned that further laundering could involve decentralised finance and instant-swap services. It urged private-sector organizations to block transactions linked to addresses used by the group.
Teng described the breach as a complex attack involving a compromised laptop and malicious software intended to erase evidence. The incident has renewed concern about North Korea’s ability to generate illicit revenue despite international sanctions, as well as wider worries about the potential effects of increasingly capable artificial-intelligence models on cryptography and IT security. Cryptocurrency prices also fell after news of the hack: bitcoin dropped nearly 5%, ether nearly 6% and Binance’s BNB token nearly 10%.
Entities: Binance, Richard Teng, TraderTraitor, Lazarus Group, Federal Bureau of Investigation (FBI) • Tone: analytical • Sentiment: negative • Intent: inform
01-11-2026
Binance, the world’s largest cryptocurrency exchange, said it would begin restoring withdrawals in phases after covering 95 per cent of the $6.3 billion in tokens stolen in a major cyberattack. The first phase was scheduled to start between 6am and 9am GMT on Sunday and include Bitcoin, ether, BNB, Solana, XRP, dogecoin and other digital assets. The remaining 5 per cent consists of less liquid tokens that Binance said could take longer to obtain in the required quantities.
The exchange temporarily suspended withdrawals as a precaution while it contained the incident’s impact, assessed affected services and conducted security checks. Binance said deposits remained open and unaffected. It said it would absorb the financial impact of the stolen funds rather than pass losses to customers, and reiterated that user funds were safe. Withdrawals would resume progressively as security and readiness checks were completed.
The FBI attributed the attack to TraderTraitor, a North Korean state-sponsored hacking unit. The agency said members of the group had converted stolen assets into ether and that it expected further laundering through related technology.
The report places the incident in the context of recurring security and governance failures in the cryptocurrency industry. It recalls the 2014 collapse of Mt Gox after large-scale Bitcoin thefts and other technical and operational failures, and the 2022 collapse of FTX amid fraud and misuse of customer funds. FTX founder Sam Bankman-Fried was later sentenced to prison. The article also notes the FBI’s attribution of a separate $1.5 billion theft from Bybit to North Korea, underscoring ongoing security threats to digital-asset platforms.
Entities: Binance, Shweta Jain, TraderTraitor, Federal Bureau of Investigation (FBI), North Korea • Tone: analytical • Sentiment: neutral • Intent: inform
