Global — November 2, 2026

The Federal Bureau of Investigation (FBI) has attributed a major cryptocurrency theft involving Binance, the world’s largest cryptocurrency exchange by trading volume, to North Korea. The security incident, which occurred on October 29, resulted in the unauthorised withdrawal of approximately $6.3 billion in digital assets, according to Binance.

In an official cybersecurity alert published on October 31, the FBI identified the activity as part of a North Korean operation it calls TraderTraitor. The agency said it had observed the attackers converting stolen assets primarily into Ethereum (ETH), with further laundering expected through decentralised finance (DeFi) platforms and instant cryptocurrency swap services.

Binance confirmed that its hot wallets had been compromised and said it was working with law enforcement agencies, blockchain intelligence companies and other industry partners to trace and recover the stolen assets. The exchange also announced that it would absorb the financial impact rather than pass the losses on to its customers.

The incident has raised serious questions about cryptocurrency exchange security, digital asset custody and the ability of international authorities to respond to large-scale cybercrime. It has also placed renewed attention on the methods used by North Korean-linked hacking groups to target the global cryptocurrency industry.

Details of the Binance Cryptocurrency Security Breach

According to Binance’s Security Incident Update published on October 30, the incident involved unauthorized withdrawals from the exchange’s hot wallets.

The company said the compromise occurred at approximately 20:05 UTC on October 29. Its investigation identified a loss of around $6.3 billion in token assets.

Hot wallets are cryptocurrency wallets connected to the internet. Exchanges use them to process transactions and facilitate withdrawals, allowing customers to move digital assets without waiting for funds to be transferred from offline storage.

Although hot wallets are essential for day-to-day exchange operations, their internet connectivity makes the security of the systems controlling them particularly important. A compromise involving the infrastructure responsible for authorising transactions can create serious risks if attackers gain the ability to initiate unauthorised transfers.

Binance’s initial investigation suggested that the incident may have involved a compromised laptop belonging to a DevOps engineer. The attacker may have used access associated with that device to reach a service container and submit unauthorized withdrawal transactions.

However, Binance subsequently reported that its investigation had uncovered additional points of breach. The company also stated that it had found no evidence that wallet private keys had been leaked.

The precise sequence of events remains subject to further investigation. Binance said it would publish a detailed technical post-incident report after the facts had been verified and disclosure would not compromise its response.

FBI Identifies North Korea’s TraderTraitor Operation

The FBI officially attributed the theft to North Korea in a cybersecurity alert dated October 31, 2026.

The agency identified the activity as TraderTraitor, a name used for a specific category of North Korean malicious cyber activity. Its announcement stated that North Korean actors were responsible for stealing more than $6 billion in virtual assets from Binance on or around October 29.

The FBI also reported that it was working with the United States Secret Service (USSS) and the Internal Revenue Service Criminal Investigation division (IRS-CI) to monitor the movement of the stolen cryptocurrency.

According to the agency, investigators had observed the attackers converting stolen assets primarily into Ethereum. The FBI expects the funds to undergo further laundering through decentralised finance services and instant swap platforms.

The agency urged private-sector organisations, including cryptocurrency service providers, blockchain infrastructure operators, decentralised finance services and virtual asset businesses, to block transactions connected to addresses being used by the attackers.

This request highlights the importance of cooperation between law enforcement agencies and the cryptocurrency industry. Although blockchain transactions are publicly recorded, tracing stolen assets and preventing their conversion or movement can require coordination among exchanges, token issuers, infrastructure providers and investigative organisations.

The FBI’s announcement represents an official attribution by US authorities. It is separate from earlier assessments made by private blockchain intelligence companies.

TRM Labs Estimates the Theft at $6.36 Billion

Blockchain intelligence company TRM Labs published its analysis of the incident on October 29, reporting that approximately $6.36 billion in digital assets had been moved from Binance-attributed wallets across ten blockchains.

The company described the incident as the largest cryptocurrency theft recorded at the time of its analysis.

TRM’s estimate differs slightly from Binance’s reported figure of approximately $6.3 billion. The two figures should be understood as separate estimates produced through different methods: Binance reported the financial impact of the incident, while TRM calculated the value of transfers it traced on-chain.

According to TRM, the majority of the stolen assets moved within approximately 20 minutes, beginning at around 20:05 UTC on October 29. The company identified activity involving several blockchain networks, including Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon.

TRM also attributed the incident to TraderTraitor, based on what it described as on-chain and off-chain intelligence.

Its analysis indicated that the attacker had prepared for the operation before the funds were transferred. TRM reported that preparations began at least 36 hours before the main theft and included preliminary activity, code deployment and testing.

These findings provide a more detailed picture of the transactions than the initial exchange announcement. However, TRM’s technical assessment should be distinguished from the FBI’s official attribution and Binance’s own investigation.

How the Attack Affected Binance’s Hot Wallets

TRM Labs’ investigation identified transfers from Binance-associated wallets across multiple blockchain networks.

The company’s analysis indicated that the attacker did not rely on a single cryptocurrency network. Instead, funds were moved from wallets associated with several chains, creating a large and complex incident involving different digital assets.

Ethereum accounted for the largest reported portion of the transfers in TRM’s analysis. Bitcoin, Tron, the XRP Ledger and Solana were among the other networks affected.

TRM also described suspicious activity involving an Ethereum hot wallet. Its investigation indicated that an EIP-7702 authorisation was used to enable the wallet to execute code associated with a sweeper mechanism controlled by the attacker.

EIP-7702 is an Ethereum technical standard that allows an externally owned account to temporarily use smart-contract functionality through an authorization mechanism. In this incident, TRM reported that the attacker used this capability as part of the process that moved funds from the affected wallet.

The activity across other blockchain networks involved standard signed transfers, according to TRM’s analysis.

These findings are significant because they suggest that the incident involved more than an isolated cryptocurrency transfer. The investigation points to a broader compromise affecting transaction authorisation across multiple wallet systems.

Nevertheless, the complete technical explanation has not yet been established through a final Binance post-mortem. The exchange said it would release additional findings after its investigation and verification process.

Approximately $3 Billion in Assets Reportedly Frozen

Following the incident, Binance said it had worked with blockchain intelligence firms, law enforcement agencies, asset issuers and other industry partners to trace and freeze affected assets.

In its October 30 security update, the exchange reported that approximately $3 billion had been frozen on-chain.

TRM Labs separately described the freezing actions taken by several digital asset companies and blockchain organisations. Its analysis reported that Tether, Circle, Ripple and World Liberty Financial had frozen affected stablecoins, while Arbitrum’s Security Council had also taken action involving assets on its network.

These measures demonstrate how different parts of the cryptocurrency industry can contribute to responding to a major theft.

Some stablecoins have centralised issuers that may be able to restrict or freeze tokens held at particular addresses. This capability can help prevent certain stolen assets from being transferred or converted.

However, freezing assets is not the same as recovering every stolen cryptocurrency. The ability to restrict movement depends on the asset, the network and the relevant issuer or service provider.

TRM’s October 29 analysis estimated that approximately $2.67 billion in stablecoins had been frozen by the named issuers, with additional assets frozen through action on Arbitrum. Its reported total was approximately $2.7 billion.

The figures represent estimates available at the time of the respective reports. They should not be interpreted as a final recovery total because asset values, transaction activity and investigative findings can change.

Binance Says It Will Cover the Financial Losses

Binance announced that customers would not be responsible for the financial impact of the stolen funds.

In its October 30 Security Incident Update #2, the exchange said it would cover the losses through its Secure Asset Fund for Users (SAFU) and corporate treasury.

Binance reported that it had set aside more than $6.34 billion in company funds, including approximately $5 billion held in the same token assets affected by the theft. At that stage, the company said it had covered approximately 80% of the impacted amount and was purchasing the remaining relevant assets through market and over-the-counter channels.

The exchange also stated that it had contained the compromised infrastructure, revoked affected authorisations and introduced additional security controls.

Its announcement was intended to reassure customers that the incident would not result in losses being passed on to users. Binance further said it planned to publish an updated Proof of Reserves after remediation work was completed.

A Proof of Reserves report is intended to provide information about an exchange’s assets and its ability to support customer balances. The updated report could therefore become an important part of Binance’s efforts to restore confidence.

However, the company’s financial commitments and recovery statements should be assessed through subsequent official updates and published documentation.

Binance Temporarily Suspends Withdrawals

As an immediate precaution, Binance temporarily suspended withdrawals while conducting security checks and implementing remediation measures.

The exchange explained that the suspension was intended to allow its teams to review affected infrastructure, revoke compromised authorisations and validate the security of its systems.

In its October 30 announcement, Binance clarified that deposits and other unaffected platform services remained operational.

The company later began restoring withdrawals in phases. According to reporting published by CBS News on November 1, Binance had reopened withdrawals for several major cryptocurrencies, including Bitcoin, Ethereum, BNB, XRP and other supported assets.

The phased restoration was intended to allow additional security checks to be completed before more assets and networks became available.

The withdrawal restrictions and subsequent restoration were important developments for customers who needed access to their digital assets. They also demonstrated the operational challenges an exchange can face when responding to a security incident involving multiple blockchain networks.

Customers Withdraw $3.64 Billion After Withdrawals Resume

The incident also created a significant test of customer confidence in Binance.

Reuters reported on November 2 that customers withdrew approximately $3.64 billion in net assets during the first nine and a half hours after withdrawals partially resumed on Sunday.

According to the Reuters report, the amount represented approximately 2.1% of Binance’s assets.

The reported figure reflected approximately $4.65 billion in withdrawals against around $1.01 billion in deposits during the period.

Binance said withdrawal activity had initially increased but was subsequently stabilising. The company also reported that it had covered approximately 95% of the stolen assets by November 2.

These developments suggest that the security incident created immediate concern among some customers, although the reported withdrawals should be considered in the context of the exchange’s overall assets and activity.

The figures do not establish that all customers intended to leave Binance permanently. They show the volume of funds moving out during the initial period after withdrawal services became available again.

For the exchange, maintaining confidence will depend on transparent communication, the completion of its technical investigation and evidence that the affected systems have been secured.

Cybersecurity Concerns for Cryptocurrency Exchanges

The Binance incident highlights the risks associated with managing large amounts of digital assets through internet-connected infrastructure.

Cryptocurrency exchanges must maintain systems that allow customers to deposit, trade and withdraw assets efficiently. At the same time, they must protect the infrastructure, credentials and authorization mechanisms that control those transactions.

A security weakness involving a device, service container or transaction approval process can create risks beyond the individual system initially compromised.

The incident also demonstrates why security controls should not depend on a single layer of protection. Exchanges need effective access management, secure device practices, transaction monitoring, independent authorisation controls and continuous security assessments.

Multi-chain operations introduce further complexity because different networks use different transaction systems, wallet structures and security mechanisms.

The Binance investigation has not yet provided a complete public explanation of every contributing factor. Therefore, it would be premature to draw definitive conclusions about the exact security failure or assign responsibility to particular individuals.

However, the scale of the reported theft reinforces the importance of regularly reviewing exchange infrastructure and ensuring that critical transaction operations are protected by appropriate controls.

The Role of International Cooperation in Crypto Investigations

The response to the Binance theft involves more than the exchange itself.

The FBI’s request for private-sector assistance illustrates the importance of cooperation between government agencies, cryptocurrency businesses, blockchain intelligence companies and service providers.

Unlike conventional financial transfers, cryptocurrency transactions are generally recorded on public blockchains. Investigators can use this information to follow the movement of assets between addresses.

However, public transaction records do not automatically reveal the real-world identity of the people controlling those addresses. Investigations may require additional intelligence, cooperation from service providers and information obtained through legal processes.

The use of decentralised finance platforms and instant swap services can also make tracing and recovery more complicated.

The FBI’s request for organisations to block transactions associated with the identified addresses is therefore an effort to reduce the attackers’ ability to move or convert the stolen funds.

The effectiveness of these measures will depend on continued cooperation and the ability of relevant organisations to identify suspicious transactions.

Investigation into the Binance Security Breach Continues

Although the FBI has attributed the theft to North Korea’s TraderTraitor operation, several aspects of the incident remain under investigation.

Binance has not yet published its final technical post-mortem. Its initial findings suggested that a compromised DevOps engineer’s laptop may have played a role, but the company subsequently reported additional points of breach.

The exchange has also said that it found no evidence of wallet private keys being leaked.

Further technical findings will be important in establishing how the attackers obtained the ability to submit unauthorized withdrawal transactions, how the affected infrastructure was compromised and what security measures are required to prevent similar incidents.

The movement and recovery of stolen assets also remain important areas to monitor. Although several organisations have reportedly frozen substantial amounts, the final amount recovered or permanently inaccessible to the attackers has not been established by the available reports.

NewsFlayer will continue to follow official announcements from Binance, the FBI and relevant blockchain intelligence organisations as further verified information becomes available.

Conclusion

The Binance cryptocurrency security breach has become one of the largest reported digital asset thefts in the history of the cryptocurrency industry.

Binance reported an estimated financial impact of approximately $6.3 billion after its hot wallets were compromised on October 29, 2026. TRM Labs separately estimated that approximately $6.36 billion in assets had moved from Binance-associated wallets across ten blockchain networks.

On October 31, the FBI officially attributed the theft to North Korea’s TraderTraitor operation and warned that the stolen assets were being converted primarily into Ethereum before further laundering.

Binance has stated that it will cover the financial impact through its SAFU fund and corporate treasury. The exchange has also worked with industry partners to freeze affected assets and gradually restore withdrawal services.

The incident highlights the importance of stronger cryptocurrency infrastructure security, effective transaction authorisation controls and international cooperation in responding to cybercrime.

As investigations continue, the final technical findings, asset recovery results and Binance’s updated Proof of Reserves will be important developments for customers and the wider cryptocurrency industry.

Sources: FBI cybersecurity alert dated October 31, 2026; Binance Security Incident Updates dated October 30, 2026; TRM Labs analysis dated October 29, 2026; Reuters reporting dated November 2, 2026; CBS News reporting dated November 1, 2026.

Note: Figures represent estimates and reported developments available as of November 2, 2026. The investigation remains ongoing, and subsequent official updates may revise some details.

NewsFlayer — Global News, National Updates and Breaking Headlines.