FBI Names North Korea in $6.3B Binance Hack: Latest Updates on Stolen Funds and THORChain
The FBI has attributed the $6.3 billion Binance hack on October 29, 2026, to North Korea's TraderTraitor operation, triggering an extensive investigation into one of the largest cryptocurrency thefts on record. Blockchain analytics firm Elliptic reported that approximately $2.85 billion in stolen assets had been frozen or seized by November 2, while billions remained in wallets associated with the attackers. Investigators also identified funds moving through cross-chain services, including THORChain, raising concerns about decentralized liquidity infrastructure and cryptocurrency security. Meanwhile, Binance has begun restoring withdrawals and replacing affected assets using company resources. The latest developments highlight the challenges of tracing stolen cryptocurrency, protecting customer funds, and restoring confidence in digital asset exchanges.
FBI Attributes $6.3B Binance Hack to North Korea’s TraderTraitor Group
The Federal Bureau of Investigation (FBI) formally linked the October 29, 2026, Binance hack to North Korea’s TraderTraitor operation on October 31, marking a major development in the investigation into one of the largest cryptocurrency thefts on record. Binance estimated that attackers stole approximately $6.3 billion in digital assets from its hot wallets, while the FBI confirmed a theft exceeding $6 billion. The attribution has intensified international efforts to track the stolen cryptocurrency, identify suspicious transactions, and prevent further movement of the assets. The incident has also renewed concerns about exchange security, sophisticated cyberattacks, and the financial risks facing centralized cryptocurrency platforms.
FBI Confirms TraderTraitor’s Involvement in the October 29 Binance Attack
In its October 31 cyber alert, the FBI identified TraderTraitor as the North Korean operation responsible for the theft. Working alongside the U.S. Secret Service and IRS Criminal Investigation, the agency reported that the attackers were converting stolen cryptocurrency primarily into Ethereum (ETH). Investigators also published blockchain addresses associated with the operation and urged cryptocurrency exchanges, blockchain infrastructure providers, and decentralized finance services to block transactions involving identified funds. These measures aim to make it more difficult for the attackers to move assets through additional platforms. However, identifying suspicious wallets does not necessarily establish the identities of their individual operators or guarantee that the stolen cryptocurrency can be recovered.
Independent blockchain intelligence firm TRM Labs supported the attribution through its analysis of the attack. In an October 29 report, the company estimated that approximately $6.36 billion had been transferred from Binance-controlled wallets across ten blockchain networks, with most withdrawals occurring within roughly 20 minutes. Its investigation identified preparation activities beginning at least 36 hours before the theft, including suspicious wallet funding, smart-contract deployment, and transaction testing. Researchers also identified similarities to earlier incidents attributed to TraderTraitor, including the February 2025 Bybit hack. These findings suggest a carefully prepared operation rather than an opportunistic attack, although the complete sequence of unauthorized access and transaction approvals remains under investigation.
Binance Security Investigation Reveals Multiple Breach Points as Market Concerns Continue
Binance's October 30 security update confirmed that unauthorized transfers began around 20:05 UTC on October 29. Its preliminary investigation suggested that attackers may have compromised a DevOps engineer's laptop, gained access to a service container, and submitted unauthorized withdrawal transactions. However, the exchange subsequently identified additional breach points, indicating that the initial explanation did not fully account for the incident. Binance reported finding no evidence that wallet private keys had been leaked and said it was working with external security specialists to establish the complete attack sequence. Separately, TRM Labs identified the use of Ethereum's EIP-7702 transaction authorization mechanism during the attack, raising important questions about how the attackers obtained transaction-signing authority. That technical assessment should not be treated as a finalized explanation of the breach.
The financial consequences extend beyond the stolen assets. Reuters reported on November 2 that Binance customers had withdrawn a net $4.72 billion after withdrawal services began reopening, representing approximately 2.8% of the platform's assets. Although Binance reported that outflows were stabilizing, the incident may continue to influence institutional confidence in cryptocurrency custody and exchange security. Binance subsequently announced another phase of withdrawal restoration beginning November 3, while its next proof-of-reserves snapshot was scheduled for November 4. A detailed technical post-mortem is also expected once the investigation is complete. These developments could provide greater clarity about operational recovery and security improvements, but they cannot establish the ultimate outcome of the investigation in advance. Further market reactions will also depend on broader cryptocurrency conditions, making it important to distinguish the hack's direct consequences from unrelated price movements.
Binance Stolen Funds Update Reveals $2.85B Frozen and Ongoing Recovery Efforts
Efforts to recover cryptocurrency stolen in the October 29, 2026, Binance hack have made measurable progress, with blockchain analytics firm Elliptic identifying approximately $2.85 billion in frozen or seized assets. This represents about 44% of the $6.43 billion theft estimated by the firm, while Binance initially reported losses of approximately $6.3 billion. Elliptic's November 2 investigation found that around $3.24 billion remained in addresses associated with the stolen funds, primarily in Bitcoin (BTC) and Ethereum (ETH). Despite substantial asset freezes, investigators continue monitoring transactions across multiple blockchain networks. The findings highlight the difference between identifying stolen cryptocurrency, restricting its movement, and recovering assets for their original owners.
Stablecoin Freezes Secure $2.85 Billion as Stolen Funds Move Across Blockchains
The recovery effort initially focused on stablecoins because issuers can freeze certain tokens before attackers convert them into other cryptocurrencies. Elliptic calculated that approximately $3.46 billion, or 54% of the stolen assets, consisted of stablecoins such as USDT and USDC. Tether and Circle responded by freezing assets linked to suspicious wallets, with stablecoins accounting for approximately 94% of the $2.85 billion frozen or seized. Circle successfully froze all 823 million USDC identified in the theft before those tokens could be exchanged. However, the attackers had already converted approximately $786 million in other stablecoins into assets including ETH and TRX before the relevant freezes took effect. This demonstrates why rapid coordination between blockchain investigators, token issuers, and trading platforms is critical when attempting to contain large cryptocurrency thefts.
The stolen funds continued moving through an extensive network of cryptocurrency wallets and blockchain protocols. Elliptic's November 2 analysis identified approximately 12,000 wallets and more than 40,000 transactions across 11 blockchain networks in less than four days. Much of the activity involved Tron, where approximately 684.6 million TRX was distributed through thousands of addresses before portions were transferred toward Ethereum using cross-chain bridges. Investigators also observed approximately 28 BTC, valued at $2.2 million at the time, entering coinjoin transactions designed to make transaction tracing more difficult. Meanwhile, the 18,270 BTC stolen directly from Binance remained unmoved across 19 addresses in Elliptic's analysis. Although these movements complicate recovery efforts, Elliptic assessed that only a negligible portion of the stolen cryptocurrency had likely been converted into cash by November 2.
Binance Replenishes 95% of Affected Assets as Recovery and Reserve Verification Continue
Alongside efforts to trace the stolen cryptocurrency, Binance has been using its own financial resources to replace affected assets and protect customer balances. In its October 30 security update, the exchange announced that it had allocated more than $6.34 billion from company resources, including its corporate treasury and Secure Asset Fund for Users (SAFU), to address the incident. By October 31, Binance reported that approximately 90% of the affected assets had been replenished, increasing to around 95% in its November 1 recovery announcement. The exchange said the remaining 5% primarily involved less liquid cryptocurrencies that require additional time to acquire through market purchases and over-the-counter transactions. Importantly, replenishing customer assets does not mean Binance has recovered the equivalent amount of stolen cryptocurrency from the attackers. The two processes involve separate financial resources and recovery mechanisms.
Binance's November 2 update introduced an additional verification measure through the completion of a zero-knowledge proof for its October 31 proof-of-reserves snapshot. The exchange stated that users holding BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC could independently verify that their recorded balances were backed by reserves of at least 1:1 at the snapshot time. Binance also scheduled another reserve snapshot for November 4, 2026, with plans to expand the assets covered. Meanwhile, withdrawal services began reopening in phases on November 1, subject to additional infrastructure and security checks. These developments provide measurable indications of operational recovery, although the final amount of stolen cryptocurrency recovered remains uncertain. Further asset freezes, new transaction-tracing findings, and progress in replenishing less liquid tokens will be important indicators of how effectively the exchange and investigators can limit the incident's longer-term financial impact.
THORChain’s Role in Binance Hack Fund Transfers and Cross-Chain Security Risks
THORChain became a significant part of the investigation into the October 29, 2026, Binance hack after blockchain analysts identified stolen cryptocurrency moving through its cross-chain swapping infrastructure. The decentralized liquidity protocol allows users to exchange native digital assets across different blockchain networks without relying on a centralized exchange. On November 1, on-chain analyst SomaXBT estimated that approximately $44 million connected to the Binance theft had moved through THORChain, while other funds traveled through services including Relay, Chainflip, and Symbiosis. The activity prompted closer scrutiny of decentralized finance (DeFi) platforms, particularly their ability to identify suspicious transactions and respond to requests from law enforcement.
How THORChain Enabled Cross-Chain Transfers of Stolen Binance Assets
THORChain facilitates cross-chain swaps using decentralized liquidity pools and network-controlled vaults that receive assets on one blockchain and release corresponding assets on another. Unlike conventional cryptocurrency exchanges, users can complete native-asset swaps without depositing funds into an exchange account. Following the Binance attack, investigators observed stolen Tron (TRX) and Tether (USDT) moving through THORChain and being exchanged for cryptocurrencies including Ethereum (ETH) and Bitcoin (BTC). SomaXBT's November 1 analysis identified approximately 185.1 million TRX and 3.83 million USDT deposited into the protocol through 2,697 transactions. The swaps reportedly produced around 17,019 ETH across 170 addresses and 53.25 BTC across 20 addresses. However, the estimated $44 million represents funds processed through the service, not cryptocurrency definitively recovered or converted into cash. These movements illustrate how cross-chain liquidity can complicate investigations by distributing stolen assets across separate blockchain networks and wallet addresses.
The FBI addressed this risk in its October 31 advisory, urging THORNode operators, remote procedure call (RPC) node operators, instant exchanges, and other virtual asset service providers to reject transactions connected to identified attacker-controlled addresses. THORChain technical co-founder Chad Barraford subsequently stated that node operators have access to publicly available blockchain information, but did not confirm whether they would block the FBI-listed addresses. This uncertainty highlights an important distinction between restrictions imposed by a website and transaction processing at the decentralized network level. Blocking access through an official interface does not automatically prevent users from submitting transactions through alternative interfaces or direct protocol interactions. Blockchain analytics firm Elliptic also identified repetitive transaction patterns involving THORChain, suggesting that automated software was helping distribute stolen assets. Its findings reinforce the importance of continuous transaction monitoring because newly created wallets may receive suspicious funds after initially appearing unrelated to the theft.
Ethereum Block Reorganization Triggers THORChain Swap Halt and Exposes Security Risks
On October 31, 2026, THORChain experienced a separate technical incident that temporarily interrupted cross-chain trading and inadvertently delayed transfers associated with the Binance attackers. The problem began at approximately 11:34 UTC when a one-block Ethereum reorganization removed a 10 ETH deposit from Ethereum's accepted transaction history after THORChain had already recognized it. A blockchain reorganization occurs when a recently accepted block is replaced, potentially reversing transactions that other systems have already processed. When the affected swap failed to meet its required price limit, THORChain issued a refund from its vault even though the original deposit was no longer valid, resulting in an additional 10 ETH payment. The protocol's automatic solvency monitoring detected the discrepancy and suspended Ethereum swaps, while node operators stopped outbound transaction signing within approximately two minutes and restricted trading on other connected networks. Reports published November 2 indicated that swaps across ten networks, including Bitcoin, Ethereum, Solana, and Tron, had been paused, although the operational status varied by network and reporting time. THORChain confirmed that the recipient voluntarily returned the extra 10 ETH, restoring the affected vault's balance. Chainalysis reported that the emergency interruption also delayed cross-chain movements involving the stolen Binance funds, but the halt resulted from a technical failure rather than a coordinated enforcement action. The incident exposed a broader security challenge for cross-chain protocols: differences in transaction finality between connected blockchains can create accounting discrepancies and unexpected payouts. Further attention will focus on improvements to transaction confirmation, refund processing, automated solvency checks, and suspicious-wallet monitoring. These safeguards may reduce operational and financial exposure, although their effectiveness will depend on implementation and continued testing.
Binance Hack Aftermath and Its Impact on Customer Withdrawals, Crypto Markets, and Future Security
The aftermath of the $6.3 billion Binance hack has raised important questions about cryptocurrency exchange stability, investor confidence, and long-term security standards. Following the October 29, 2026, attack, Binance temporarily suspended withdrawals while strengthening its security infrastructure and assessing the financial impact. Although the exchange began restoring services on November 1, substantial customer withdrawals and increased market volatility highlighted concerns about centralized cryptocurrency custody. The incident has also intensified scrutiny of asset protection, transaction authorization, and the ability of exchanges to respond to large-scale cyberattacks. Future developments will depend on Binance's operational recovery, additional security findings, and the effectiveness of measures designed to protect customer assets.
Binance Customer Withdrawals Reach $4.72 Billion After Services Resume
Binance experienced significant customer withdrawals after reopening its platform, with Reuters reporting approximately $4.72 billion in net outflows by November 2, 2026. The amount represented roughly 3% of the exchange's reported assets, indicating a meaningful withdrawal response without establishing a broader liquidity crisis. Binance stated that withdrawal activity was stabilizing after an initial increase and reported approximately $2.7 billion in customer inflows since services resumed. The exchange adopted a phased reopening strategy, prioritizing supported blockchain networks while completing additional security assessments. Although deposits remained operational, some cryptocurrency withdrawals continued to face network-specific restrictions. Another phase of withdrawal restoration was announced for November 3, covering additional assets on networks including Ethereum, BNB Smart Chain, Solana, XRP Ledger, and Sui. The gradual restoration of services helped address immediate accessibility concerns, but the longer-term recovery of customer confidence will depend on reliable withdrawals, transparent financial disclosures, and continued operational stability.
Bitcoin and Ethereum Market Reactions Highlight Investor Confidence Risks
The Binance security breach coincided with heightened cryptocurrency market volatility and increased attention to exchange-related risks. Bitcoin (BTC) reached a six-week low on October 30 before recovering above $77,000 on November 2, while Ethereum (ETH) also rebounded after approaching a two-month low. Market reporting showed that U.S. spot Bitcoin exchange-traded funds recorded approximately $643 million in outflows on October 30, alongside more than $1.3 billion in leveraged cryptocurrency liquidations. However, broader market conditions, changing investor sentiment, and existing trading positions may also have contributed to these movements, making it difficult to attribute the declines entirely to the Binance hack. Analysts observed that the incident had not triggered widespread financial-market disruption, although its scale could influence institutional assessments of digital asset custody and operational risk. Sustained uncertainty around exchange security may encourage investors to place greater emphasis on custody arrangements, liquidity management, and independently verifiable asset backing rather than short-term cryptocurrency price movements alone.
Future Exchange Security Depends on Stronger Safeguards and Transparent Verification
The Binance hack has highlighted weaknesses that cryptocurrency exchanges must address as digital asset trading becomes increasingly connected to institutional financial services. Important security priorities include stronger transaction authorization, tighter control over privileged system access, improved monitoring of hot wallets, and independent testing of withdrawal infrastructure. Binance's November 2 announcement confirmed that users could independently verify at least 1:1 reserve backing for ten major cryptocurrencies through a completed zero-knowledge proof covering its October 31 snapshot. The exchange scheduled another proof-of-reserves snapshot for November 4, with plans to expand the assets covered and generate an updated verification proof. Binance also committed to publishing a detailed technical report once its investigation is complete, which could clarify the underlying security failures and the measures taken to address them. However, reserve verification demonstrates asset backing within a specified reporting scope and does not independently establish that every operational vulnerability has been resolved. The most important developments to monitor are the completion of remaining asset replenishment, broader withdrawal restoration, updated security disclosures, and progress in identifying and recovering stolen funds. These outcomes will help determine the incident's longer-term implications for Binance and security practices across the cryptocurrency industry.
Conclusion
The $6.3 billion Binance hack has become a major test of cryptocurrency exchange security, coordinated asset recovery, and financial transparency. The FBI's attribution to North Korea's TraderTraitor operation has strengthened efforts to identify suspicious transactions, while Elliptic's November 2 findings show that approximately $2.85 billion in stolen cryptocurrency had been frozen or seized. However, substantial funds remain outside issuer-controlled restrictions, and cross-chain transfers continue to complicate investigations.
Binance's reported 95% asset replenishment, phased withdrawal restoration, and expanded reserve verification demonstrate progress in addressing the immediate financial impact. Nevertheless, the final security findings and the ultimate amount of stolen cryptocurrency recovered remain uncertain. Further updates on withdrawal availability, reserve backing, and the promised technical investigation will be important for evaluating Binance's recovery and the broader implications for digital asset security.
FAQs
Will Binance users receive compensation for assets affected by the hack?
Binance has committed to covering the financial impact of the October 29, 2026, security breach using company resources. However, this commitment should not be confused with an unconditional guarantee against every potential loss. Affected users should review their account balances, transaction records, and official support notifications to confirm whether their individual holdings require further action.
What should users do if their Binance cryptocurrency withdrawals are delayed?
Users experiencing delayed Binance withdrawals should first check the withdrawal status, supported blockchain network, and transaction history within their accounts. If a withdrawal remains pending, they should contact Binance's official customer support rather than repeatedly submitting transactions. Never disclose passwords, private keys, or verification codes to anyone claiming to offer faster withdrawal processing.
Can stolen Bitcoin and Ethereum be frozen like stablecoins?
Bitcoin and native Ethereum assets generally cannot be frozen by a central token issuer because their blockchain networks do not provide that type of issuer-controlled restriction. However, cryptocurrency exchanges can restrict deposits or withdrawals associated with identified suspicious wallets. Some stablecoins have smart-contract functions that allow their issuers to freeze specific token balances, making rapid intervention possible when stolen assets are identified.
How can Binance users independently verify their cryptocurrency reserves?
Binance users can access the exchange's official proof-of-reserves verification system to check whether their eligible balances were included in a published reserve snapshot. The October 31, 2026, snapshot uses a Merkle tree and zero-knowledge proof to verify reserve backing without publicly exposing individual account balances. However, proof of reserves reflects specified assets at a particular reporting time and does not replace a comprehensive financial or cybersecurity audit.
Can stolen cryptocurrency still be traced after multiple cross-chain swaps?
Yes. Blockchain investigators can often follow cryptocurrency transfers across public networks by examining transaction histories, wallet relationships, and cross-chain bridge activity. However, repeated swaps, address changes, and privacy-enhancing techniques can make tracing more difficult. Identifying the movement of stolen cryptocurrency does not automatically establish who controls the receiving wallets or whether the assets can ultimately be recovered.
Disclaimer: This general market information, possibly from third-party, commercial, or sponsored sources, is provided for reference and educational purposes only and does not constitute financial or investment advice, an offer, solicitation, or guarantee. We disclaim liability for its accuracy, completeness, reliability, and any resulting losses. Investments/trading are risky; past performance doesn’t guarantee future results. Users should research, judge prudently, and take full responsibility. For further details, please consult KuCoin’s Terms of Use and Risk Disclosure.