Customers pull $3.6bn from Binance as it reopens after the $6.3bn heist the FBI blames on North Korea
From the Newshound archive · first published 1 November 2026 · last updated 2 November 2026.
The FBI warned that those responsible for the Binance raid are converting stolen funds into Ethereum and laundering them through decentralised finance platforms.Kim Jong Un, whose country's TraderTraitor unit carried out the Binance raid using access gained through a compromised DevOps engineer's laptop, according to investigators.
Binance co-CEO Richard Teng confirmed the exchange has covered 95% of the stolen assets using company funds, buying replacement tokens on the open market, with the remaining 5% — less liquid cryptocurrencies — expected to take longer to source. Outflows stabilised after an initial spike, and Teng pledged users would bear none of the financial losses from the October 29 attack.
The FBI identified the culprit as TraderTraitor, a North Korean state-sponsored group operating under the Lazarus Group umbrella, which previously stole a then-record $1.5bn from Bybit in 2025.
Trump publicly contradicted the FBI, telling reporters at Mar-a-Lago 'we don't know if it's North Korea' and saying his administration was still 'learning about' the attack.
Analysts believe the $6.3bn theft may be the largest financial robbery in history, dwarfing previous crypto heists and funding Kim Jong-un's nuclear programme.
