Overview
- The theft on Oct. 29 drained about $6.3 billion from Binance hot wallets in roughly 20 minutes and prompted the exchange to suspend withdrawals while it investigated.
- The FBI has publicly attributed the attack to TraderTraitor, a hacking operation tied to North Korea, and is coordinating with the U.S. Secret Service, IRS‑CI and Justice Department while urging crypto firms to block listed wallet addresses.
- Binance worked with stablecoin issuers and analytics firms to freeze targeted balances, has resumed withdrawals in phases and says it has covered roughly 90–95% of customer losses from company reserves.
- Blockchain investigators traced the haul through roughly 12,000 wallets and more than 40,000 transactions on about 11 chains, reporting roughly $2.7–2.85 billion frozen or seized and about $3.2–3.24 billion still in linked addresses being laundered via Tron, cross‑chain bridges, decentralized exchanges and occasional mixers.
- Pyongyang, through Kim Yo Jong, rejected the U.S. attribution as a political provocation, a stance that raises diplomatic tension and leaves markets watching whether the billions still on‑chain will be gradually cashed out through over‑the‑counter trades or blocked by further enforcement.