The FBI said Saturday evening that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about Oct. 29. The statement, posted by the FBI’s Cyber Branch at about 6:37 PM ET and shared by the bureau’s main account, is the first official government attribution of the attack.
Per Reuters and the AP, the FBI tied the theft to TraderTraitor, the North Korean state-sponsored group it previously linked to the roughly $1.5 billion Bybit hack. The bureau said it had observed the group converting stolen assets into Ether and expects further laundering. That matches the private-sector read: Chainalysis and TRM had already attributed the hack to TraderTraitor, but until now there was no government confirmation.
On-chain tracing continues. Elliptic said Saturday that the main Tron distribution wallet linked to the stolen funds has paid out roughly every hour for 31 hours, with repeated swap amounts into THORChain, a pattern it described as automated laundering.
Binance’s own figures are unchanged since Update #3 on Saturday morning: about $6.3 billion affected, more than $6.34 billion set aside, about 90% of stolen assets replenished, and about $3 billion frozen on-chain. Crypto withdrawals are still paused. Binance’s support account said Saturday evening that security checks are being completed, with P2P and fiat withdrawals available where supported. The company has said it is on track to restart withdrawals Sunday, Nov. 1, but has not confirmed a time.
Still pending: a confirmed withdrawal restart, the zero-knowledge proof-of-reserves results (estimated by Tuesday, Nov. 3, UTC), and Binance’s technical findings and post-mortem. No regulator action has been announced.
Markets were steady. At 7:47 PM ET, CoinGecko showed Bitcoin at $77,433 (+0.3% over 24 hours), Ether at $2,253 (+0.5%) and BNB at $702.60 (−0.2%).
Sources: FBI, Reuters, AP, Binance, Elliptic, Chainalysis, CoinGecko