Short answer: On Saturday, October 31, 2026, the FBI said TraderTraitor, a North Korean state-sponsored hacking unit, was responsible for the theft of about $6.3 billion from Binance. Agents have seen the group converting stolen assets into ether and expect "further laundering". Binance says it has replaced 90% of the stolen amount with company money and is on track to reopen withdrawals on Sunday, November 1. Markets took the hit on Friday: US spot Bitcoin ETFs lost $643.2 million, ending a four-day inflow streak and turning October negative, and bitcoin traded around $77,000.
What did the FBI say?
The FBI's statement, reported by Reuters and NBC News, attributes the attack to TraderTraitor, the same group the bureau blamed for the February 2025 Bybit theft of about $1.5 billion. Blockchain analytics firms TRM Labs and Chainalysis had pointed to the group a day earlier, as we described in Binance hack: $6.3 billion stolen. Converting stolen tokens into ETH is a familiar first step for this group: ether is liquid, hard to freeze and easy to route through bridges and mixers afterwards.
Binance itself had not confirmed North Korean involvement before the FBI statement, saying only that it was working with law enforcement. Its co-CEO Richard Teng repeated that the attack combined a compromised laptop with malicious software designed to erase evidence.
How is Binance covering the loss?
According to NBC News, Binance used three sources to buy back the stolen tokens: part of its $1 billion Secure Asset Fund for Users (SAFU), a reserve held mostly in bitcoin for exactly this situation; part of its futures insurance fund; and its corporate treasury. "We've now replenished 90% of the stolen assets, and we're committed to covering the remaining 10%," Teng wrote on X. The remaining tenth is in less liquid tokens that take longer to buy without moving their prices.
Binance also took a fresh proof-of-reserves snapshot as of midnight GMT on Saturday. Users holding any of ten tokens — BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC — will be able to check that their balances are backed at least one-to-one once the full proof is published.
Key facts
| Item | Detail |
|---|---|
| Attribution | FBI, October 31, 2026: TraderTraitor (North Korea) |
| Laundering | Stolen assets being converted to ETH; FBI expects more laundering |
| Replaced | 90% of stolen assets, from SAFU, futures insurance fund and treasury |
| Proof of reserves | Snapshot at 00:00 GMT October 31 for 10 tokens |
| Withdrawals | On track to reopen on Sunday, November 1 |
| Spot BTC ETFs | −$643.2 million on Friday, October 30; four-day inflow run ended |
| Bitcoin | About $77,000; Fear & Greed Index around 30 (Fear) |
Why the market reacted
A hack at the largest exchange touches everything: liquidity on order books, confidence in centralized custody and the risk that stolen coins get dumped. The selling pressure arrived on top of an already nervous week: the Fed held rates with two votes for a hike, as covered in Fed holds rates at 3.75-4%, and tech stocks were weak. The quick coverage of losses helped limit the damage; most analysts so far do not see a solvency problem at Binance.
What to do this weekend
- Ignore "compensation" offers. The FBI attribution and reopening news will bring a new wave of phishing. Use only the Binance app or the site you type yourself.
- Verify your balance with the proof-of-reserves tool once it is live, especially if you hold one of the ten listed tokens.
- Plan your withdrawal. Expect queues when withdrawals reopen. Choose a network with low fees and check the address twice; see USDT network fees.
- Reduce exchange exposure. Keep on exchanges only what you trade. For swaps that pay straight to your wallet, compare services in Changerella App or the exchangers list.
FAQ
Who does the FBI say hacked Binance?
TraderTraitor, a North Korean state-sponsored hacking unit. The FBI said on October 31, 2026, that the group was converting the stolen assets into ether and that further laundering is expected.
Has Binance replaced the stolen crypto?
Mostly. Binance said it had replaced 90% of the stolen amount using its SAFU fund, futures insurance fund and corporate treasury, and that it will cover the remaining 10% of less liquid tokens.
When will Binance withdrawals reopen?
Binance said it was on track to reopen withdrawals on Sunday, November 1, 2026.
How did the Binance hack affect Bitcoin ETFs?
US spot Bitcoin ETFs saw net outflows of $643.2 million on Friday, October 30, ending a four-day run of inflows and leaving October with net outflows. Bitcoin fell to around $77,000.