Binance hack: the FBI names North Korea's TraderTraitor as withdrawals start to return

For nearly three days, people with coins on Binance could look at their balance but not move it. On Sunday morning that began to change. Bitcoin withdrawals were live by about 07:00 UTC on 1 November, and ether, the two big dollar stablecoins (USDT and USDC) and BNB followed within the hour.

The reopening came hours after a second piece of news. On Saturday 31 October, the FBI said North Korean hackers it calls TraderTraitor carried out the Binance hack, a theft Binance puts at about $6.3 billion. When we first covered the Binance withdrawals pause, that was the view of private analysts. Now it is an official US government finding.

The FBI’s case against TraderTraitor

In an alert titled “North Korea Responsible for $6 Billion+ Binance Attack”, the FBI said the theft was the work of TraderTraitor, a North Korean state hacking group. It worked on the case with the US Secret Service and the criminal investigators of the US tax agency (IRS-CI).

According to the FBI, the hackers turned most of the stolen coins into ether. It expects more laundering, which means moving money around to hide where it came from. That will likely run through DeFi apps, which have no company in the middle, and “instant swap” services.

So the FBI asked the industry for help. It wants exchanges, node operators, DeFi services and blockchain analytics firms to “block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets,” as CoinDesk quoted it.

This is the same group the FBI blamed for the theft of about $1.5 billion from the exchange Bybit in February 2025.

North Korea has not responded publicly. Asked by reporters on Saturday, US President Donald Trump said: “We’re learning about it. We don’t know if it’s North Korea, but if it is, we’ll talk to them about it.”

Binance hack recovery: 95% covered, 15 networks first

In its fourth recovery update, at 04:08 UTC on Sunday, Binance said phase one of withdrawals would open between 06:00 and 09:00 UTC. It covers 15 networks, picked by last week’s user demand, including Bitcoin, Ethereum, BNB Smart Chain, Solana, XRP and Base. Each comes with its main coin plus USDT and USDC.

Binance also said it has now covered about 95% of the stolen amount, up from 90% a day earlier. It says balances in ten coins, including bitcoin, ether, USDT, BNB and Solana, are “fully backed 100%”. The last 5% is smaller, less traded tokens.

“These losses will not be passed on to users,” the exchange wrote. It promises a full post-incident report once the investigation ends.

Is Binance safe for you now? A calm checklist

If you hold coins on Binance (general good practice, not financial advice):

• Check before you send. Look at Binance’s announcement page or the withdrawal screen for your coin and network. Others reopen in later phases, with no dates yet.
• Expect delays. Binance warned of delays and said some attempts may need a retry. Try again later rather than rushing.
• Use only official channels: the Binance app, its announcement page and its verified X account.
• Say no to “recovery” offers. Big hacks bring scammers. No real support agent asks for your password, 2FA code or seed phrase (the secret words that control a wallet).
• Lock things down. Turn on 2FA and a withdrawal address allowlist, so coins go only to addresses you approved.

Why naming the hackers helps, and where it stops

The good news is real. A named attacker and a public list of addresses make the stolen coins harder to cash out. When exchanges and analytics firms refuse money linked to those addresses, the thieves have fewer doors to use. Binance, too, has kept its public promises: it reported the losses, put up the money and reopened on the day it said.

The harder truth is that attribution is not recovery. In our reading of past cases, money taken by state hackers is rarely returned, because the people behind it are far beyond the reach of police and courts. Binance’s own customers are protected because Binance is paying, not because the coins are coming back. The same group is now blamed for two of the largest exchange thefts on record in under two years. That suggests the industry’s defences are still a step behind.

On balance, this is a steadier day for Binance users than any since Thursday. The bigger question now is how it happened, and that answer is in the post-incident report.

Watch for the next withdrawal phases and that report. Until then, the quiet moves are the safe ones: check the official app, move coins only when you need to, and trust no stranger who offers to help.