Binance Users Withdraw $3.6B as FBI Confirms North Korean Hack

Key points

• Binance processed $4.65 billion in withdrawals and $1.01 billion in deposits on November 1, resulting in a net outflow of $3.64 billion.
• The exchange stated it had covered 95% of the $6.3 billion loss, with major assets like Bitcoin and Ethereum fully backed, while less liquid tokens remain in sourcing.
• The FBI identified the attack as the work of North Korea's 'TraderTraitor' group, noting hackers converted stolen assets primarily into Ethereum.
• Blockchain analytics firms observed automated laundering efforts, with funds moving through bridges and swap services like THORChain at high speed.
• Circle froze over $1.1 billion in USDC linked to the incident, while the FBI urged virtual asset service providers to block transactions tied to specific addresses.

Background

This incident follows the largest cryptocurrency heist in history, which occurred on October 28, 2026. Binance initially suspended all deposits and withdrawals after hackers stole approximately $6.3 billion, causing Bitcoin prices to drop below $78,000. The exchange pledged to cover customer losses using its Secure Asset Fund for Users and corporate reserves. Investigations suggested the breach involved a compromised DevOps engineer's laptop, allowing attackers to access service containers.

How outlets are covering it

Gizmodo and CNBC emphasize the scale of user withdrawals, noting that while Binance claims 98% of users chose to stay, significant outflows occurred in the first few hours. Fox Business highlights the geopolitical implications, quoting President Trump’s cautious stance on North Korean involvement and expert Eric Schiffer’s warning of an 'AI hacking bloodbath.' Gizmodo details the technical sophistication of the laundering, describing automated movements through Tron and THORChain, while Fox Business focuses on the FBI's official attribution and the broader cybersecurity risks. All sources agree on the $6.3 billion figure and the exchange's commitment to cover losses, but differ in emphasis between technical laundering mechanics and political/cybersecurity warnings.

Why it matters

The event underscores the vulnerability of major crypto exchanges to sophisticated state-sponsored attacks and the rapid evolution of laundering techniques. The FBI's direct call for non-custodial services to block transactions signals a shift in regulatory enforcement, potentially impacting the decentralization principles of protocols like THORChain. The incident also highlights the growing role of AI in cyberattacks, as warned by security experts, and the resilience of the crypto ecosystem in absorbing a record-breaking loss without immediate systemic collapse.

What to watch

Binance is expected to continue sourcing less liquid tokens to fully cover the remaining 5% of the loss. The FBI and other agencies will likely monitor blockchain activity for further laundering attempts, potentially leading to legal actions against service providers that fail to block flagged transactions. The crypto industry may face increased scrutiny regarding the balance between decentralization and compliance with law enforcement requests, particularly concerning protocols like THORChain that have been linked to previous North Korean hacks.