Ing. Calogero Bono
On Sunday Binance began gradually reopening withdrawals, following the roughly $6.3 billion theft of October 29. On Saturday the FBI attributed the attack to TraderTraitor, a North Korean group linked to Lazarus. Binance says it has already covered about 95% of the amount and does not intend to pass the losses on to users. It matters because it is the largest cryptocurrency theft ever recorded, and because it shows how a single compromised computer can open the door to losses of this size.
A few terms before we get into the facts. TraderTraitor is the name the FBI uses for North Korean cyber activity, the group is also known as Lazarus, Jade Sleet and APT38. DeFi refers to decentralized finance services, used to move funds without intermediaries. Instant swap services exchange one cryptocurrency for another on the fly. SAFU is Binance's fund meant to protect users. Proof-of-Reserves is the page showing that balances are backed one to one.
What did the FBI say about the Binance theft?
In the statement reported by BleepingComputer the FBI states that North Korea is responsible for the theft of over 6 billion dollars in virtual assets, which occurred around October 29, 2026. The activity is called TraderTraitor.
The attribution follows that of TRM Labs and Chainalysis, which had already linked the heist to the same group. The Verge notes, however, that the agency has offered few other details or proofs. We also covered this in this article.
How were the funds stolen?
According to what Binance reported earlier, the intrusion started from the compromised laptop of a DevOps engineer. This allowed the attackers to access a service container and send unauthorized withdrawals.
About 6.36 billion dollars were taken across ten blockchains, largely within just 20 minutes. You can find the initial reconstruction in this piece.
Where is the stolen money going?
The FBI has observed TraderTraitor converting the funds mostly into Ethereum. It expects further laundering through DeFi platforms and instant swap services.
The FBI, Secret Service and IRS Criminal Investigation are asking exchanges, blockchain operators and other service providers to block transactions linked to the addresses used. The published list counts 628 addresses, namely 608 Ethereum, 19 Bitcoin and one Solana.
When will withdrawals return on Binance?
According to TechCrunch the reopening is gradual and depends on the network and the type of asset. On Sunday morning the status page showed mixed situations, with Bitcoin partially suspended and Ethereum with normal deposits and partial withdrawals.
Punto Informatico reports 15 networks in the first phase, including Bitcoin, Ethereum and Tron. Binance warns of possible delays due to high traffic and promises a detailed report once the investigation is concluded.
Limits to know
Several points remain open. The FBI has provided few public details or evidence. Binance has not yet published the full incident report. Sources give different times for the restart of withdrawals, and the stolen amount varies between 6.3 and 6.36 billion. The 95% coverage figure is declared by the exchange and has not been independently verified. We do not know how much of the funds will be recovered.
What changes for those working in digital
The mechanics are known. The weak point was the computer of a person with privileged access. According to the source, North Korean groups also use fake recruiters and fake job assessments to get developers to install malware. If you manage servers or sensitive access, keep work devices separate from personal ones and limit permissions. A hosting with managed security updates reduces the attack surface, but it does not replace training. A similar case of theft through third-party scripts is that of Polymarket.
Our take
The most significant data point is not the amount but the method. Billion-dollar thefts happen because a laptop gets breached, not because encryption is broken. Binance's response, with declared coverage and gradual withdrawals, is reassuring, but it rests on numbers supplied by the exchange itself. The final report will be needed to judge. The FBI's attribution, while consistent with private analyses, would also need more public evidence to stand on.
Frequently asked questions
Who stole the $6.3 billion from Binance?
According to the FBI, the North Korean group TraderTraitor, also known as Lazarus. The attribution follows those of TRM Labs and Chainalysis. Few public proofs have been released.
Will Binance users lose their money?
Binance says no. It states that losses will not be passed on to users and that about 95% of the amount has been covered. The remaining 5% concerns less liquid tokens.
Are withdrawals on Binance already active?
Only partly. The reopening is gradual and depends on the network and the asset. Delays are possible due to high traffic.
How did the attack happen?
Binance links it to the compromised laptop of a DevOps engineer. This gave access to a service container and to unauthorized withdrawals.
What is happening to the stolen funds?
They are being converted mostly into Ethereum. The FBI expects laundering through DeFi services and instant swaps, and has published 628 addresses to block.
What to watch in the coming weeks in the Binance case
The operational crisis is winding down, the informational one is not. The final report and the fate of the funds are what matter.
- Read Binance's detailed report when it is published and compare its account with the FBI's.
- Check the network status page before moving funds, since the reopening is happening in phases.
- Verify whether coverage rises above 95% and whether the less liquid tokens are completed.
Sources
- bleepingcomputer.com, FBI links $6.3 billion Binance crypto heist to North Korean hackers
- techcrunch.com, Binance resumes withdrawals following $6.3 billion breach
- theverge.com, North Korea linked to massive Binance crypto heist
- punto-informatico.it, Binance ripristina i prelievi, FBI conferma autori del furto
