The FBI ties Binance's $6.3bn hack to North Korea. Withdrawals are coming back in phases

In brief

Developing. Last updated 1 November 2026, 19:43 Dubai time (UTC+4).

Binance, one of the largest cryptocurrency exchanges, estimates that about $6.3bn was stolen in a security incident disclosed on 30 October 2026. On 31 October the FBI said North Korea was responsible for the theft of more than $6bn from Binance "on or about October 29, 2026", and named the activity "TraderTraitor".

Binance says it will absorb the loss, not its users. In its latest update, published on 1 November 2026 at about 08:08 Dubai time (UTC+4), it said it had covered approximately 95% of the impacted amount and is reopening withdrawals in phases.

What Binance has said

• The cause. Binance's initial investigation, published on 30 October, suggests a compromised DevOps engineer's laptop gave an attacker access to a service container, from which unauthorised withdrawals were submitted. It said it found no evidence that wallet private keys leaked.
• Freezes. In the same update Binance said about $3bn had been frozen on-chain with blockchain partners. Update #4 does not restate it.
• Coverage. The figure rose from about 80% to 90% and then, on 1 November, to about 95%. Binance says the outstanding 5% is in less liquid tokens outside its top ten assets, which it is still buying through market and OTC channels.
• Withdrawals. Phase one was scheduled to start on 1 November between 06:00 and 09:00 UTC (10:00 to 13:00 Dubai time) across 15 networks, including Bitcoin, Ethereum, BNB Smart Chain, Solana and Tron. Binance says it chose tokens by the past week's user demand and will add more networks once checks are complete. It gave no date for later phases. Deposits were not affected.

What the FBI said

The FBI, working with the US Secret Service and IRS Criminal Investigation, says TraderTraitor actors are converting stolen assets mainly into Ethereum and are expected to launder them further through DeFi and instant swap services. It asks node operators, instant exchanges, DeFi services and analytics firms to block transactions involving the addresses it published.

Why it matters

ByteNib's reading is that the entry point matters more than the size. A single engineer's laptop reportedly reached a service that could submit withdrawal transactions. That is an identity and endpoint problem that any organisation with privileged engineers shares, not just crypto exchanges.

What leaders should do next

1. Map who can move money. List every engineer and service account that can reach payment or withdrawal systems, and how its endpoint is protected.
2. Separate build access from production signing. A DevOps laptop should not be one step from releasing funds.
3. Screen counterparties. If your business touches digital assets, check flows against the FBI's address list.

Sources and scope

Primary sources: the FBI alert North Korea Responsible for $6 Billion+ Binance Attack (31 October 2026); Binance's Security Incident Update (30 October 2026) and Recovery Update #4 (1 November 2026), all checked on 1 November 2026. Context only: AP, Reuters via Investing.com, CoinDesk and the Guardian. Some outlets reported 90% coverage; that was Binance's previous update, before the 95% figure on 1 November. Loss, coverage and cause figures are Binance's own and unaudited; the attribution is the FBI's. The "Why it matters" and recommendations are ByteNib editorial analysis.

Drafted with AI assistance and reviewed by the editor before publication.

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.