# FBI pins Binance's $6.3 billion hack on North Korea: how it happened, and the scams that followed

> The FBI says North Korea's TraderTraitor group stole more than $6 billion from Binance's hot wallets on October 29, likely the biggest crypto theft on record. Binance says it is covering the loss and has restarted withdrawals, while fake 'compensation' offers circulate.

Published Nov 3, 2026 by TechMeasured Staff · Security · Canonical: https://techmeasured.com/security/fbi-north-korea-binance-6-3-billion-hack-tradertraitor

The FBI has attributed the theft of more than $6 billion in crypto from **Binance** to North Korea, naming the government-linked group it tracks as **TraderTraitor**, according to Help Net Security and Fox Business. Binance estimated its loss at about $6.3 billion when it disclosed the October 29 breach. Help Net Security calls it likely the largest crypto theft on record.

Why it matters: the attack hit the world's largest crypto exchange, and the haul is more than four times the $1.5 billion Bybit theft attributed to the same group. The FBI tied TraderTraitor to that February 2025 Bybit hack, Help Net Security notes, and Fox Business says the October 31 alert is the first public confirmation of North Korea's role from U.S. federal investigators, after blockchain analysts TRM Labs and Chainalysis pointed there within a day.

## How the attackers got in

Binance's account is still evolving:

- It first said the intrusion may have started with a **compromised DevOps engineer's laptop**, which gave access to a service container and allowed unauthorized withdrawals (Help Net Security).
- It later found "additional points of breach," and said the attacker used a **self-destruct mechanism** to wipe tools and traces (Decrypt).
- Co-CEO Richard Teng said the attacker used an **EIP-7702 delegation** to gain execution approval over a hot wallet — a step that, he said, did not go through Binance's normal approval controls (Decrypt).

Teng also said the theft hit Binance's own hot wallet, not customer funds, and that most user assets sit in cold storage. A post-incident report is promised once the investigation ends.

## Following the money

| Item | Figure | Source |
|---|---|---|
| Reported loss | ~$6.3 billion | Binance, via Help Net Security / Fox Business |
| Frozen within first day (Tether, Circle, others) | close to $3 billion | Help Net Security |
| Addresses the FBI wants blocked | 628 (608 Ethereum, 19 Bitcoin, 1 Solana) | Help Net Security |
| Company funds Binance reserved | more than $6.34 billion | Decrypt |
| Stolen assets replaced so far | ~95% (up from ~90% on Saturday) | Help Net Security, Fox Business |

The FBI, working with the Secret Service and IRS Criminal Investigation, says the hackers converted most of the haul to Ethereum and expects further laundering through DeFi platforms and instant swap services. Teng's line to customers: Binance "will absorb the financial impact of the stolen funds, not our users," per Help Net Security.

## Where things stand

Withdrawals began reopening in phases on November 1, with order based on user demand from the prior week, Help Net Security reports. Binance says balances in ten major assets — including BTC, ETH, USDT, BNB, SOL and USDC — are fully backed and points users to its proof-of-reserves page. The remaining ~5% shortfall is mostly in less liquid tokens outside the top ten, which the exchange is still buying. Deposits have run normally since early in the incident.

## What Binance users should do

- **Ignore "compensation" offers.** Fake posts and screenshots promising a $150 reward to affected users are circulating; Binance staff have called them fake, and co-founder Changpeng Zhao warned scammers are very active (Help Net Security).
- **Use only official Binance channels** for status updates, and never act on unsolicited messages that send you into the app or ask for credentials.
- **Expect delays** on withdrawals during heavy traffic; retry after a short wait rather than through third-party "support."
- **Check your own holdings** against Binance's published reserves if you hold one of the less liquid tokens that aren't yet fully backed.

## What to watch

Binance's post-incident report, which should explain how one compromised machine reached hot-wallet signing; how much of the ~$3 billion frozen is actually recovered; and whether other exchanges using EIP-7702-style delegations tighten their approval paths. In both Bybit and Binance, the reported entry point was the people and machines around the keys, not the cryptography itself.


## Sources

1. [Help Net Security — FBI pins $6.3 billion Binance crypto heist on North Korea while scammers circle anxious users](https://www.helpnetsecurity.com/2026/11/02/fbi-north-korea-binance-hack/)
2. [Fox Business — FBI says North Korea stole over $6 billion in Binance crypto hack](https://www.foxbusiness.com/technology/north-korea-responsible-6-billion-binance-cryptocurrency-hack-fbi-says)
3. [Decrypt — Binance sets aside $6.34B to cover hack losses, CEO says 'your assets are safe'](https://decrypt.co/382237/binance-sets-aside-6-34b-to-cover-hack-losses-ceo-says-your-assets-are-safe)