Overview
- The theft was executed around Thursday, October 29, when attackers used compromised internal access to move about $6.3 billion in crypto from Binance wallets.
- Binance began phased reactivation of withdrawals on Sunday and says it has replaced roughly 95% of affected assets using corporate reserves, its SAFU protection fund and OTC purchases.
- The FBI publicly attributed the operation to TraderTraitor, a hacking unit tied to North Korea’s Lazarus network, and released roughly 500 Ethereum addresses it says are linked to laundering the stolen funds.
- Investigators and blockchain firms report that the attackers are converting assets into Ethereum and moving them through DeFi and instant-swap services, and on-chain freezes and blocking efforts are ongoing.
- The breach has renewed concern that state-linked cybertheft funds sanctioned programs, triggered sharp crypto price drops, and prompted public scrutiny from political leaders as probes and recovery work continue.