Statements

It was not clear whether there was any immediate political advantage to be gained from the hack, which was widely attributed to a North Korean group, but Republican and Democratic sides began staking out positions almost immediately.

Yet, picking politically attractive proxy-scapegoats is a classic pro move.

I think NK is a convenient target to blame, instead of highlighting that random events from random insiders across different financial operations are the actual cause.

The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."

On October 31, the FBI attributed the theft to TraderTraitor, its name for a North Korean state-sponsored hacking group. This confirms Elliptic's earlier assessment.

frozen funds don’t necessarily equate to recovered funds. Immobilizing assets prevents the suspected attackers from spending them, but it doesn’t automatically return them to Binance or its users.

“USDT is real money backed by dollars, and the position is criminal but overcollateralized in the eyes of the protocol.”

Elliptic also cautioned that the onchain overlap with the Bitget incident involved only a small portion of the Binance funds and did not conclusively establish that the same attackers were responsible.

TRM cited similarities to previous North Korean operations, including Tornado Cash funding, advance staging and pre-signed authorizations.

Selig characterized the attack as a laptop-introduced vulnerability rather than a blockchain flaw—but Binance has since found “additional points of breach.”

The company said in 2024 that it had more than $160bn in assets under its custody.

This was not carried out by one person.

It had initially suspended all deposits and withdrawals - but then said in an update that "deposits remain unaffected".

Several experts have warned customers not to regard Binance's promise to cover losses as legally binding and said they may need to pursue litigation to recover them.

But crypto history watchers have been pointing out online that this is exactly the kind of message that FTX CEO Sam Bankman-Fried gave before his crypto exchange collapsed in 2022, leading to huge losses for customers and the industry.

Temporarily suspended withdrawals while conducting additional security reviews, implementing remediation measures and validating the integrity of affected systems.

We are buying the remaining 20% of the lost token assets. We plan to run an initial Proof Of Reserves snapshot in 12 hours and have the result ready by Monday 2026-11-02.

We have already set aside more than $6.34B in company funds, with $5B held in the exact impacted token assets that were stolen, such as USDC, USDT, BTC, ETH, BNB, etc. This means that we have already covered approximately 80% of the impacted amount.

We want to be clear about our commitment: Binance will absorb the financial impact of these stolen funds, not our users.

For verified updates, please follow Binance's official channels only, or contact us directly through the official Customer Support.

we will provide a detailed technical report outlining what happened, the lessons learned and the additional safeguards being implemented.

We expect to share further technical findings within about 48 hours once they have been verified and their disclosure will not compromise ongoing investigative efforts.

Binance will cover all stolen funds related to this incident through our Secure Asset Fund for Users (SAFU) and our corporate treasury.

The tech team targets to start resuming the withdrawal service within approximately 34 hours, subject to the completion of security checks. This will proceed on a phased approach.

Our initial investigation suggested that the incident may involve a compromised laptop, however, our subsequent investigation has uncovered additional points of breach. At this stage, we have found no evidence that wallet private keys were leaked.