---
title: "Binance covered 95% of the $6.3 billion crypto theft with its own money; the FBI blames North Korea"
description: "Binance reopened withdrawals on November 1 after using company money to replace 95% of the $6.3 billion stolen; the FBI attributes it to North Korea's TraderTraitor unit. The customer-protection fund was never the cushion; the corporate treasury was."
publisher: "The Inference"
section: "Security"
published: 2026-11-01T16:27:02.311Z
modified: 2026-11-01T16:27:02.311Z
canonical: https://theinference.org/article/binance-covered-95-of-the-6-3-billion-crypto-theft-with-its-own-money-the-fbi-blames-north-korea
language: en
keywords: "Binance, Crypto, North Korea, Cybersecurity, Hack"
---

# Binance covered 95% of the $6.3 billion crypto theft with its own money; the FBI blames North Korea

> Binance reopened withdrawals on November 1 after using company money to replace 95% of the $6.3 billion stolen; the FBI attributes it to North Korea's TraderTraitor unit. The customer-protection fund was never the cushion; the corporate treasury was.

The largest theft in crypto history did not end with the thieves; it ended on [Binance](https://theinference.org/markets/companies/binance)'s balance sheet. On November 1, 2026, the exchange [reopened bitcoin withdrawals, the first network in a phased restart, after replacing 95% of the stolen tokens with company money](https://wtvbam.com/2026/11/01/binance-to-resume-withdrawals-after-recovering-bulk-of-6-billion-in-stolen-funds/) [1].

The FBI attributed the theft to TraderTraitor, a North Korean state-sponsored hacking unit, in [a October 31 alert issued with the Secret Service and IRS Criminal Investigation](https://www.nbcnews.com/business/business-news/fbi-says-north-korea-was-6-billion-binance-crypto-hack-rcna606758) [2][3]. Binance's 335 million registered users are being made whole by one treasury, and that fact now prices every platform that holds other people's crypto [2][3].

## The break-in was a laptop; no blockchain failed

Co-CEO Richard Teng says the breach began with a compromised laptop and malware built to erase its traces [1]. The drain itself, in blockchain-analytics firm [Elliptic's on-chain analysis](https://cryptoticker.io/en/binance-hack-fbi-blocklist-addresses/), needed no stolen key: a single Ethereum transaction carrying 50 pre-signed authorizations handed a Binance hot wallet to a sweeper contract that emptied it [3].

That is North Korea's method. [TRM Labs' ledger](https://www.trmlabs.com/resources/blog/north-korea-has-stolen-usd-128-billion-in-crypto-usd-74-billion-of-it-in-2026) shows almost nine-tenths of everything it has stolen came from attacks on the keys and signing systems behind wallets rather than bugs in code; every other hacker combined gets a fifth of their value that way [4].

## One state is now most of the stolen market

TRM counts $12.8 billion taken by North Korea-linked hackers since 2017, and this year one state accounts for most of all crypto theft worldwide [4].

*Chart: **North Korea's share of everything hacked in crypto: 7% in 2020, 85% this year** Columns rising from 7 percent in 2020 to 39 percent in 2024, 63 percent in 2025 and 85 percent in 2026, with the 2026 column highlighted.*

*Percent of total value stolen in crypto hacks worldwide, for the years TRM reports; 2026 runs through October 29, 2026. Source: TRM Labs. [4]*

## The freezable billions stopped; the rest escaped

Stablecoin issuers such as [Tether](https://theinference.org/markets/companies/tether) and Circle froze nearly $2.7 billion within hours, because a stablecoin carries its issuer's freeze function; the Arbitrum Security Council acted too [4]. [The attacker still holds about $2.4 billion in ether and bitcoin, which no issuer can reach](https://theinference.org/article/north-korea-took-6-36-billion-from-binance-and-2-4-billion-is-beyond-any-freeze) [4].

The laundering runs at software pace: Elliptic watched a Tron wallet push funds into the cross-chain swap protocol THORChain every hour for 31 straight hours, "[moved by something that does not sleep](https://www.forbes.com/sites/digital-assets/2026/11/01/binance-reopens-withdrawals-says-company-cash-covered-95-of-hack/)" [5]. [The FBI's alert now asks swap services and node operators to block](https://thecurrencyanalytics.com/crypto-exchanges/fbi-binance-hack-north-korea-tradertraitor-307238), not only exchanges [3][6]. The one moment stolen funds can be stopped is the window between theft and conversion into native assets, and shortening that window is exactly what TRM sells [4][7].

## The insurer of last resort was the exchange itself

Half of the $1 billion Secure Asset Fund for Users, the customer-protection reserve, went in; the futures insurance fund and the treasury paid the rest, with SAFU to be refilled and [a full proof of reserves promised by November 3](https://coincentral.com/binance-reopens-bitcoin-withdrawals-after-6-3b-hack-says-95-of-stolen-crypto-replaced/) [1][8]. The theft was more than six times that fund's entire size [1][4].

Most platforms could not write that check, and the market now knows which one can. For anyone holding or backing a crypto platform, reserve size and security spend have become valuation line items, and the analytics vendors that shorten the freeze window collect that spend; [TRM's homepage sells an AI investigation platform for exactly this job](https://www.trmlabs.com/) [7]. Watch which exchanges disclose reserve shortfalls next.

Customer funds turned out to be exactly as safe as the balance sheet behind them.

## Takeaway

Binance reopened withdrawals after covering 95% of the $6.3 billion theft from its own treasury, while the FBI pinned the breach on North Korea's TraderTraitor unit; reserve size and security spend are now valuation line items for every platform holding other people's crypto.

## Sources

1. [Reuters via WTVB AM, "Binance resumes bitcoin, ether withdrawals after covering bulk of stolen $6.3 billion", 1 November 2026](https://wtvbam.com/2026/11/01/binance-to-resume-withdrawals-after-recovering-bulk-of-6-billion-in-stolen-funds/)
2. [NBC News (Reuters), "FBI says North Korea was behind the $6.3 billion Binance crypto hack", 31 October 2026](https://www.nbcnews.com/business/business-news/fbi-says-north-korea-was-6-billion-binance-crypto-hack-rcna606758)
3. [CryptoTicker, "Binance hack: FBI names North Korea and lists more than 600 addresses", 1 November 2026](https://cryptoticker.io/en/binance-hack-fbi-blocklist-addresses/)
4. [TRM Labs, "North Korea Has Stolen USD 12.8 Billion in Crypto, USD 7.4 Billion of It in 2026", 30 October 2026](https://www.trmlabs.com/resources/blog/north-korea-has-stolen-usd-128-billion-in-crypto-usd-74-billion-of-it-in-2026)
5. [Forbes, Javier Bastardo, "Binance Reopens Withdrawals, Says Company Cash Covered 95% Of Hack", 1 November 2026](https://www.forbes.com/sites/digital-assets/2026/11/01/binance-reopens-withdrawals-says-company-cash-covered-95-of-hack/)
6. [The Currency Analytics, "FBI links $6 billion Binance theft to North Korea", 1 November 2026](https://thecurrencyanalytics.com/crypto-exchanges/fbi-binance-hack-north-korea-tradertraitor-307238)
7. [TRM Labs homepage, "TRM Labs | AI Investigations and Blockchain Intelligence", accessed 1 November 2026](https://www.trmlabs.com/)
8. [CoinCentral, "Binance Reopens Bitcoin Withdrawals After $6.3B Hack, Says 95% of Stolen Crypto Replaced", 1 November 2026](https://coincentral.com/binance-reopens-bitcoin-withdrawals-after-6-3b-hack-says-95-of-stolen-crypto-replaced/)


---

Binance covered 95% of the $6.3 billion crypto theft with its own money; the FBI blames North Korea — The Inference. Canonical: https://theinference.org/article/binance-covered-95-of-the-6-3-billion-crypto-theft-with-its-own-money-the-fbi-blames-north-korea