The FBI has attributed the theft of more than $6 billion in virtual assets from Binance to North Korea, according to an alert published on October 31. The agency named the operation TraderTraitor and asked cryptocurrency providers to block transactions tied to 628 addresses.
The announcement came as the exchange phased withdrawals back online and fraudsters circulated claims of a $150 compensation program. The FBI crypto heist attribution adds a significant threat: affected customers must distinguish official recovery updates from convincing but false messages.
- The FBI says North Korea was responsible for the Binance theft on or about October 29, 2026.
- About $6.3 billion left Binance wallets, making it likely the largest cryptocurrency theft in history.
- The agency linked the incident to TraderTraitor, previously named in the February 2025 Bybit hack.
- Binance restored withdrawals in phases beginning November 1 and said it had replaced about 95% of stolen assets with its own funds.
- Scammers used fake posts and screenshots to promote a nonexistent $150 compensation reward.
How the Binance crypto heist unfolded
About $6.3 billion moved out of Binance wallets on October 29. The exchange initially said an attacker may have entered through a compromised DevOps engineer’s laptop, gaining access to a service container and then authorizing withdrawals. Its investigators later found additional breaches, according to helpnetsecurity.com.
Blockchain intelligence firms TRM Labs and Chainalysis attributed the attack to TraderTraitor within a day. That earlier identification helped distinguish this theft from the many compromises that have targeted cryptocurrency platforms over the past several years.
Binance suspended withdrawals while it investigated and restored affected systems. It began a phased reopening on November 1, with the first networks and assets scheduled between 6 and 9 a.m. UTC. The exchange based the sequence on customer demand, but required each network and asset pair to pass stability and security checks.
Deposits continued operating during the incident. Fiat access also resumed: by November 2, Binance listed 28 supported currencies. Newly added options included the US dollar, UAE dirham, Vietnamese dong, Philippine peso and Indonesian rupiah.
The recovery effort
The FBI is working with the US Secret Service and IRS Criminal Investigation to trace the stolen assets. According to the agency, the group converted most of them into Ethereum. Investigators expect further movement through decentralized finance platforms and instant swap services.
Crypto providers are being urged to block transactions associated with 628 listed addresses. The wallet mix included 608 Ethereum addresses, 19 Bitcoin addresses and a single Solana address.
Tether, Circle and other partners reportedly helped freeze close to $3 billion during the first day. Such freezes can stop funds from moving, but they do not guarantee that every affected customer receives the full value of their assets back immediately.
Binance said it replaced roughly 95% of the stolen assets with its own money, an increase from 90% cited in an earlier update. The remaining 5% consisted of less liquid tokens outside the ten largest assets by market value, which the exchange said were harder to purchase at the required scale through market and over-the-counter channels.
For BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC, Binance reported full backing of customer balances. Customers could verify the exchange’s position through its proof-of-reserves page.
Why this matters beyond Binance
The FBI’s attribution gives the incident a clear geopolitical dimension. North Korean-linked actors have repeatedly targeted cryptocurrency services, where a successful intrusion can produce immediate, transferable assets. That makes crypto platforms different from many traditional cybercrime targets: stolen funds can begin moving across chains and services as soon as attackers gain control.
The usual response after a major exchange hack is a mix of asset freezes, wallet tracing and exchange reimbursement. Here, those measures exist alongside a practical strain on users. Even when an exchange covers the financial loss, delayed withdrawals can disrupt trading, payroll, savings strategies or emergency access to money.
Scammers benefit from that uncertainty. Fake posts and screenshots appeared quickly, claiming Binance would pay affected users a $150 reward through the app. The scam combines a genuine service disruption with a plausible-looking compensation offer, two details that can make fraudulent messages more convincing.
The key distinction is verification. An announcement about restored withdrawals may appear alongside messages promising extra payments, referral links or a limited-time support form. An official recovery notice should not require users to connect a wallet, disclose a seed phrase, pay a fee or follow a shortened link from a social post.
A worked example for crypto users
Say you use Binance and your withdrawal has been delayed. You see a social post saying every affected user can claim $150 before the offer expires.
Don’t treat the payment claim as evidence that your withdrawal is finished. First, open the exchange directly through its usual app or website rather than tapping a link in the post. Review the withdrawal status and any recovery notice published through the account itself. If you need assistance, use the exchange’s established support channel and ask for a transaction status or balance confirmation.
Once a withdrawal is available, check the network, asset and destination address before approving it. A delayed or failed request should not be retried immediately if the first transaction may still be processing; duplicate submissions can complicate reconciliation. Binance advised users waiting for a failed withdrawal to try again after a short delay.
Also watch your email, messaging apps and social channels for impersonation attempts. Fraudsters may copy official language, but timing alone doesn’t authenticate a message.
What to watch next
The next test is whether the remaining stolen assets can be identified before they disappear into decentralized finance or swap services. Asset freezes may continue, but every transfer creates another opportunity for investigators to recognize, document and challenge the movement of funds.
For users, the immediate issue remains operational. Watch for notices about additional networks, currencies and settlement delays, especially because high traffic can slow processing. Verify every recovery message through an official Binance channel, and treat any compensation offer found only in social posts as suspicious until confirmed independently.
Bottom line: the FBI has named North Korea as responsible for the Binance crypto heist, but recovery still depends on tracing assets, freezing wallets and restoring orderly withdrawals. The clearest threat to users right now is not only the theft itself; it’s the wave of scams using the disruption to impersonate the exchange.
Key takeaways
- The FBI attributed the more than $6 billion Binance theft to North Korea and linked it to TraderTraitor.
- Binance says it has covered about 95% of stolen assets, while phased withdrawals face possible delays.
- Users should verify recovery notices through official exchange channels and never pay a fee to claim a supposed reward.
Frequently asked questions
Did the FBI confirm North Korea was behind the Binance theft?
Yes. The bureau attributed the incident to North Korea, placed its value at more than $6 billion and identified TraderTraitor as the operation involved.
Has Binance restored withdrawals after the crypto heist?
Binance began a phased resumption on November 1. It restored services by network and asset after stability and security checks, while warning that heavy traffic could cause delays.
Is Binance offering affected users $150 in compensation?
Binance warned that posts and screenshots claiming a $150 reward were fake. Users should rely on official announcements rather than social-media claims.
What should I do if my Binance withdrawal is delayed?
Check your account through the official app or website, review the transaction status and use Binance’s established support channel if needed. Avoid links, shortened addresses and requests for wallet credentials or payment.