In Focus | A week after the roughly $6.3 billion Binance hack: FBI blames North Korea, Binance says about 98% of assets replenished

In the early hours of October 30, Beijing time, the hot wallets of cryptocurrency exchange Binance were attacked. Binance's first announcement put the loss at about $6.3 billion, and its November 3 preliminary investigation report estimated the affected digital assets at about $6.34 billion. The Associated Press called it the biggest crypto heist in history; it is roughly four times the size of the approximately $1.5 billion stolen from Bybit in 2025. The US Federal Bureau of Investigation (FBI) said on October 31 (US Eastern time) that North Korea was responsible, and referred to the related malicious cyber activity as TraderTraitor. Binance has pledged to cover all losses itself and, since November 3, has said it has replenished about 98% of the affected assets; it began restoring withdrawals in phases on November 1. According to SoSoValue, US spot Bitcoin ETFs recorded their largest single-day net outflow since June on October 30. At 07:00 Beijing time on November 6, Bitcoin traded at about $75,600, roughly 6% below its level before the attack began. The incident has also reignited debate in the US over offshore exchange regulation and the CLARITY Act.

What happened: months of infiltration, about $6.3 billion moved in under four hours

According to Binance's official announcement, at around 04:05 Beijing time on October 30 (20:05 UTC on October 29), Binance's hot wallets were breached and unauthorized withdrawals occurred, causing a loss of about $6.3 billion in token assets. Binance immediately suspended withdrawals, while deposits and other unaffected services continued to operate. In its first announcement, it said it had found no evidence that wallet private keys were leaked.

Binance released a preliminary investigation report on November 3, and co-CEO Richard Teng and Chief Security Officer Jimmy Su described the intrusion in a media briefing the same day. According to the report and CoinDesk's coverage of the briefing, in June a wallet operations engineer searching for a coding tool downloaded a tampered Homebrew installation package; in September, another engineer was approached through a legitimate recruitment platform by someone posing as a project lead and, after two rounds of interviews, was asked to download a coding assignment onto a work computer; the assignment contained zero-day malware capable of bypassing endpoint security protections. On October 20, the attackers used a compromised computer and an internal tool to gain access to the devices of two wallet engineers; on October 29, they used stolen credentials to deploy containers and run malicious scripts, and exploited Ethereum's EIP-7702 authorization mechanism to gain execution rights over the hot wallets. Because the hot wallets used a multi-party computation (MPC) architecture, there was no single private key that could revoke that authorization immediately. The final unauthorized transfer was confirmed on-chain at 23:56 UTC on October 29, and Binance revoked the malicious authorization at 00:10 UTC on October 30. Teng described it as "a campaign, built over many months."

Attribution: FBI blames North Korea, Pyongyang denies

Blockchain analytics firms including TRM Labs pointed to the North Korean hacking group TraderTraitor soon after the incident. In a statement on October 31 (US Eastern time), the FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, and referred to this North Korean malicious cyber activity as TraderTraitor; in February 2025, the FBI likewise attributed the roughly $1.5 billion Bybit theft to TraderTraitor. The FBI said law enforcement had observed the actors converting the stolen assets primarily into Ethereum, and expects them to launder funds further through decentralized finance and instant swap services; together with the US Secret Service and IRS Criminal Investigation, it urged exchanges and other industry players to block transactions involving the related addresses.

US President Donald Trump said on the evening of October 31 (US local time), "We don't know if it's North Korea," but did not rule out that North Korea could ultimately be found responsible. On November 3 (local time), North Korea's official Korean Central News Agency (KCNA) carried a statement by Kim Yo Jong, sister of Kim Jong Un, rejecting the FBI's attribution and calling it an attempt to brand North Korea a cybercrime state.

On the movement of the stolen funds, CoinDesk reported on November 4 that the attackers had begun converting some assets into Bitcoin through the cross-chain protocol THORChain. Blockchain analytics firm Elliptic assessed that the amount of stolen funds already cashed out was likely negligible; Chainalysis noted that THORChain's suspension of trading on October 31 had also slowed the laundering.

Binance's response: absorbing the loss, restoring withdrawals in phases

Binance said the loss from the stolen assets would be borne by Binance, not its users. According to Binance's October 31 announcement, the replenishment funds come from part of the Secure Asset Fund for Users (SAFU), part of the futures insurance fund and the company's own funds, and Binance has set aside more than $6.34 billion. The replenishment percentages disclosed in Binance's successive announcements were about 90% on October 31, about 95% on November 1, and about 98% from November 3; the remainder is being purchased through market and over-the-counter channels. "Replenished" means Binance has used its own resources to make up the affected assets, and does not mean the stolen funds have been recovered. On recovery, Binance said on November 3 that about $2.85 billion in assets had been frozen or intercepted, and that the figure could still change with reconciliation and price movements.

Withdrawals resumed in phases from 14:00 Beijing time on November 1 (06:00 UTC), with the first batch including Bitcoin, Ethereum, USDT, USDC, BNB and XRP, while the remaining assets and networks are being reopened progressively as they pass security and stability checks. According to data published by Binance, between 06:00 and 15:30 UTC on November 1, the platform processed $4.6 billion in withdrawals and $1.0 billion in deposits, a net outflow of $3.6 billion, or about 2.1% of its total assets under management. On reserves, Binance published on October 31 a reserve snapshot as of 08:00 Beijing time that day, covering 10 assets; on November 2 it said the corresponding zero-knowledge proof had been generated, allowing holders of those 10 assets to verify for themselves that their balances are backed by reserves of at least 1:1. A new snapshot at 00:00 UTC on November 4 expanded coverage to 44 assets, and Binance then expected the zero-knowledge proof to take about 50 to 60 hours to generate. Binance said it will engage independent third-party cybersecurity experts to conduct a full review of the incident, and the investigation is ongoing.

Market: Bitcoin about 6% below pre-attack level, ETFs post largest single-day outflow since June

According to Coinbase hourly data, Bitcoin traded at about $80,700 before the attack began (20:00 UTC on October 29). It fell about 4.3% from open to close on October 29 (UTC) and at one point dropped to about $76,100 intraday on October 30 (UTC). Bitcoin then traded in a wide range, rising above $81,000 at one point on November 4 (UTC) before falling back on November 5; at 07:00 Beijing time on November 6 it traded at about $75,600, roughly 6% below its level before the attack began.

On flows, according to SoSoValue, US spot Bitcoin ETFs recorded a net outflow of about $643 million on October 30, the largest single-day outflow since June 25, wiping out about 64% of the year-to-date cumulative net inflows of slightly more than $1 billion. According to Farside Investors, net outflows continued on November 2 and 3, and flows turned to a small net inflow on November 4.

Regulation and industry reaction: offshore exchange oversight back in focus

At a press conference on October 30 (US local time), Trump said he was looking into the matter and that Binance had said it was ensuring customers get their funds back. "But it's a hack. That's the problem," he said. "So I've always felt it was a little bit dangerous." Commodity Futures Trading Commission (CFTC) Chairman Michael Selig told CNBC that the incident proved the point behind the CFTC's move earlier in October to begin drafting rules for crypto markets. "The real issue here is that these are unregulated offshore exchanges," he said. On October 5, the CFTC issued an advance notice of proposed rulemaking on the subject, seeking public comment.

In Congress, Republican Senator Cynthia Lummis, who has been involved in negotiations on market structure legislation, said on social media that hackers stole more than $6 billion from Binance in less than four hours; she argued that had the CLARITY Act already been in force, crypto firms would have had legal cover to freeze suspicious transactions when requested by law enforcement. The bill passed the House of Representatives in July 2025; on September 15, a procedural vote in the Senate to begin debate failed 49-50. According to Reuters, citing sources familiar with the matter, regulators at the Federal Reserve and the Office of the Comptroller of the Currency (OCC) began contacting several banks on the morning of November 2 (US local time) to ask whether their systems showed vulnerabilities, unusual activity or service disruptions; both agencies declined to comment.

In the industry, Coinbase said in a blog post on November 4 that it was unaffected by the incident and that more than 99% of customer assets are held in cold wallets. Binance co-founder Changpeng Zhao called on the industry to form an alliance to freeze stolen funds faster.

What's next

Binance still has to complete the purchase of the remaining roughly 2% of assets, generate the proof of reserves covering the 44 assets, and open withdrawals for the remaining assets and networks; the independent review and investigation findings have not yet been published. The further handling of the roughly $2.85 billion in frozen or intercepted assets, and the attackers' subsequent laundering routes, remain a focus for the market.

Risk notice: This material is for reference only and does not constitute investment advice. Financial markets involve risk, and past performance does not indicate future results.