FBI blames North Korea for $6.3 billion Binance hack as withdrawals reopen

When customers can move money: Binance said its "next milestone" is resuming withdrawals by Sunday, subject to security checks and final confirmation. Deposits were not affected, AP reported. Co-CEO Richard Teng said Binance would share a full proof-of-reserves report, an accounting of the assets backing customer balances, by Monday, the BBC reported.

The US investigation: The Secret Service said its investigators are "working around the clock with our private-sector partners, including Circle, to identify, freeze, trace and recover funds stolen from Binance," and that it is coordinating with the U.S. Attorney's Office for the District of Columbia, Fox Business and the BBC reported. The FBI said it is "aware of the incident and is engaged with relevant public and private partners" Nextgov/FCW reported; on Saturday the FBI publicly attributed the attack to North Korea. Asked Friday whether North Korea was involved, President Trump told reporters, "We're looking at that," adding that he has "always felt it was a little bit dangerous," referring to crypto, AP and Fox Business reported.

Who is suspected: Blockchain-analytics firm TRM Labs said "with high confidence" that the attack was carried out by TraderTraitor, a North Korean state-backed unit the FBI blamed for the $1.5 billion Bybit theft in February 2025, and Chainalysis CEO Jonathan Levin also pointed to TraderTraitor. TRM said about $6.36 billion left Binance wallets on 10 blockchains, most of it in about 20 minutes. Binance has only said it is working with law enforcement "to confirm the identity of the criminals."

How it happened is still unclear: Binance first said the breach may have started with a compromised laptop belonging to one of its engineers. Teng later said the attack was not the work of one person, involved more "points of breach" and used a "self-destruct mechanism" that erased the attackers' tools and makes the investigation harder, AP reported. Binance said it has found no evidence that wallet private keys leaked.

Timeline: Thursday, Oct. 29: about $6.3 billion moves out of Binance hot wallets; deposits and withdrawals are paused. Friday, Oct. 30: Binance says it has set aside more than $6.34 billion to cover losses and about $3 billion is frozen; the FBI and Secret Service confirm they are involved; Trump says officials are looking at a North Korea link. Saturday, Oct. 31: Binance says about 90% of the stolen assets are re-backed and withdrawals should reopen Sunday.

Two views on what it means: Eric Schiffer of Patriarch and Reputation Management Consultants told Fox Business that Binance's balance sheet means "they're going to recover," but warned "the bloodbath of AI hacking is to come" and that the exchange will lose customers' trust. Independent analyst Garrick Hileman told AP there is evidence the hackers are already moving and converting some of the money that was not frozen, which makes it harder to trace.

What's still unknown: whether the frozen $3 billion can be returned (that often takes court orders); how much of the unfrozen money has already been laundered; and what Binance's proof-of-reserves report shows.

Updated Oct. 31, 2026 with Binance's Saturday statement, Secret Service and FBI statements and President Trump's comments. The '90% covered' figure is Binance's own claim and refers to balances refilled from its reserves, not money recovered from the attacker. The North Korea attribution comes from private blockchain-analytics firms TRM Labs and Chainalysis; the FBI publicly confirmed the North Korea attribution on Oct. 31. Dollar totals differ slightly by firm and crypto prices move, so figures are approximate. Photos are file images (2023). Updated Nov. 1. The 95% figure is Binance's own claim.