Binance is confronting the aftermath of a record-breaking security breach that the Federal Bureau of Investigation has attributed to the North Korean cyber unit TraderTraitor. The attack, which occurred around October 29, drained an estimated $6.3 billion in virtual assets from Binance hot wallets, making it one of the largest thefts in crypto history.
North Korea, through senior official Kim Yo Jong, rejected the FBI’s attribution as politically motivated and dismissed the claim as “absurd rhetoric,” according to state media. The FBI said it has observed the group converting stolen assets into Ether, with additional laundering expected through DeFi venues and instant-swap platforms. Authorities have asked exchanges, DeFi services and blockchain analytics firms to freeze transactions from wallets linked to the hackers. Reuters reported that more than $1.1 billion in USDC had been frozen as of November 2, while $3.28 billion worth of Bitcoin and Ether remained in hacker hands.
Binance said it has already reimbursed roughly 95% of the stolen amount and resumed withdrawals in phases. After reopening, customers pulled a net $4.72 billion, with about $2.7 billion in returns flowing back, while outflows represented roughly 3% of platform assets. The exchange’s proof-of-reserves update showed 1:1 backing for major assets including BTC, ETH, BNB, SOL, USDC, USDT and XRP.
Separately, Binance said a purported ShinyHunters listing claiming 335 million user records was likely a scam. The threat actor demanded $900,000 in Bitcoin or Monero for data allegedly including credentials and private keys. Binance said an initial review found no evidence of a new systems breach and noted inconsistencies such as plaintext passwords and external wallet private keys, suggesting the data may come from infostealer malware on individual devices.
The October attack was linked to compromised employee devices and stolen credentials, allowing unauthorized access to wallet signing infrastructure. Binance later requested the return of 8,425.997 ETH and approximately 74.56 million ARB frozen after the incident, while investigators continue tracking billions of dollars moving across blockchains and decentralized platforms.
