Overview
- The theft, which occurred Thursday, Oct. 29, drained roughly $6.3–6.43 billion from Binance hot wallets across multiple blockchains in about 20 minutes and forced the exchange to suspend withdrawals.
- The FBI on Oct. 31 publicly attributed the attack to TraderTraitor, a hacking unit linked to North Korea, and urged exchanges and blockchain operators to block transactions from identified wallet addresses.
- Pyongyang rejected the claim: Kim Yo Jong and state media called the FBI’s attribution ‘absurd rhetoric’ and a political provocation, escalating diplomatic friction with Washington.
- Blockchain investigators say about $2.85 billion has been frozen or seized by issuers and authorities while roughly $3.24 billion remains in linked wallets undergoing complex laundering through thousands of addresses, cross-chain bridges and DeFi swaps.
- Binance says it has covered most customer losses from company reserves, has resumed phased withdrawals, and investigators warn that recovering and proving final control of laundered crypto will take months and require off-chain forensics and international cooperation.