FBI Attributes Binance Theft to TraderTraitor Group as Exchange Restores Withdrawals
The FBI attributed the theft of more than $6 billion in virtual assets from Binance to North Korea and TraderTraitor activity. The exchange is gradually restoring withdrawals and says approximately 95% of the affected assets are covered.
The TraderTraitor attack on Binance, in which more than $6 billion in virtual assets were stolen on October 29, was attributed to North Korea by the FBI. In a statement dated October 31, the U.S. agency identified the attackers’ activity as TraderTraitor. Binance has meanwhile been gradually restoring withdrawals and said that approximately 95% of the affected assets are already covered.
The FBI also published addresses it associates with the movement and laundering of the stolen assets. Further actions by the FBI, USSS and IRS-CI concerning these addresses remain under monitoring.
The TraderTraitor attack on Binance and available technical information
Binance initially reported that the incident may have been connected to a compromised DevOps engineer’s laptop. The attacker allegedly used the device to gain access to a container service and initiate unauthorized withdrawals.
However, in a later security notice, the exchange said that the investigation had uncovered additional points of entry. The compromised laptop therefore cannot be considered the only confirmed cause of the incident. Binance did not disclose the attack’s exact technical sequence, the scope of all affected systems, or the role of the individual entry points.
According to Binance, there is no evidence that wallet private keys were leaked during the incident. The exchange also stated that it will cover the losses from its own resources and the SAFU fund.
Withdrawals are gradually returning
Binance is gradually restoring withdrawals and said that approximately 95% of the affected assets are covered. According to the exchange, the remaining portion mainly concerns less liquid tokens.
A date for the full restoration of all withdrawals has not yet been published. The final amount of the damage, the volume of assets that were frozen or recovered, and the exact scope of compensation for affected users have also not been definitively confirmed.
Why the case matters
In terms of scale, the case ranks among the most serious incidents in the cryptocurrency sector and directly affected the operation of a major exchange. It highlights the risk of compromising administrative workstations and internal services used to manage hot wallets.
However, the facts released so far do not allow the conclusion that the entire TraderTraitor attack on Binance was caused by the failure of a single device. Binance confirmed the existence of additional points of entry, without details about their nature or how they related to one another.
What to watch next
- Binance’s technical post-mortem report with a more complete description of the intrusion chain,
- further announcements from the FBI, USSS and IRS-CI concerning addresses associated with TraderTraitor,
- the status of withdrawal restoration, independently verifiable Proof of Reserves data, and the actual scope of coverage for the affected assets.
Sources
- FBI – The FBI attributes the theft on October 29, 2026, worth more than $6 billion, to North Korea and the TraderTraitor group.
- Binance Support – Security Incident Update #2 – Binance reports additional points of entry, no evidence of leaked private keys, and a plan to restore services and compensate losses.
- Binance Announcement – The exchange reports the gradual restoration of withdrawals and approximately 95% coverage of the affected assets.
- CSO Online – A current summary of withdrawal restoration, asset coverage and the FBI’s attribution.
Verified and updated: 11/02/2026 15:22
