FBI Exposes the Largest Cryptocurrency Hacking by North Korea in History! What is the Truth Behind the Disappearance of $6.3 Billion?

Approximately $6.3 billion worth of cryptocurrency was siphoned from a single exchange.

Regarding the hacking incident that struck Binance, one of the world's largest cryptocurrency exchanges, the FBI announced on October 31, 2026, that North Korea was responsible. The FBI specifically pointed to a cyber activity known as "TraderTraitor."

This incident, reported by France-Antilles as the "heist of the century," not only highlights the massive scale of the loss but also raises questions about the security of large platforms that hold cryptocurrencies.

Binance has promised not to pass the losses onto its customers and is working to replenish the assets. However, "replenished," "stolen assets returned," and "able to withdraw freely" each represent different states. Understanding the incident requires not confusing these three.

※The following information is based on what was confirmed by the morning of November 1, 2026. The investigation and recovery are ongoing, and the schedule does not imply completion.

The "TraderTraitor" Named by the FBI

According to the FBI's announcement, the incident occurred around October 29. It is reported that over $6 billion in cryptocurrency was stolen from Binance. Binance's indicated scale of damage is approximately $6.3 billion.

The name TraderTraitor is not appearing for the first time in this incident.

In February 2025, the FBI also attributed a theft of approximately $1.5 billion from the cryptocurrency exchange Bybit to North Korea, using the same name. The damage to Binance this time is about 4.2 times larger by simple comparison.

However, using the same name as in the past does not necessarily mean that the entry routes and attack methods were entirely identical. Identifying the perpetrators and technically understanding how they breached the system need to be considered separately.

Do Not Jump to Conclusions That "Cryptography Was Broken"

Hearing about a massive outflow of cryptocurrency might make one feel as if the cryptographic technology underpinning Bitcoin or Ethereum was breached.

However, Binance's official explanation does not indicate such a conclusion.

The company explained that, in addition to a potentially compromised laptop, additional entry points were found. Meanwhile, as of the announcement, there is no evidence confirming that wallet private keys were compromised.

It's important to note here that "no confirmation of private key leakage" is not the same as "unable to make unauthorized transfers."

In general, the security of the mechanism for moving assets does not solely depend on key storage. Systems that accept transfers, operational authority, and approval procedures are also involved. Which mechanism was exploited and in what order in this case requires waiting for the investigation results.

The original article also touches on concerns about the advancement of AI. However, based solely on the official announcements confirmed this time, one cannot conclude that "AI cracked the cryptography and stole the assets."

"90% Replenishment" Does Not Mean 90% Recovery of Stolen Assets

On October 31, Binance explained that it had replenished 90% of the lost assets.

This is a significant development, but it is crucial to understand its meaning accurately. According to reports, the company is repurchasing cryptocurrencies corresponding to the stolen ones using company funds. The remaining 10% includes assets with low liquidity, which take time to procure.

In other words, it is not a story of recovering 90% of the stolen assets from the perpetrators.

"Replenishment" is when the company covers the shortfall. "Freezing" is to prevent the movement of the targeted assets. And "recovery" is to retrieve the stolen assets.

For example, while an exchange may supplement customer assets with its funds, it may also separately proceed with freezing and recovering the stolen assets. These figures cannot be simply added up and interpreted as the "percentage of damage resolved."

The "90%" this time should first be read as a figure representing the progress of replenishment.

Why Stolen Assets Are Exchanged for Other Cryptocurrencies

The FBI explained that the perpetrators are mainly exchanging the stolen assets for ETH. Furthermore, it pointed out the possibility of money laundering progressing through decentralized financial services (DeFi) and services that allow quick cryptocurrency exchanges.

If the stolen assets are left in one place, they are more likely to be tracked or have transactions stopped. Therefore, they change the type of assets and their destinations to complicate the flow of funds.

However, moving on the blockchain does not erase all records.

The analysis company Elliptic reported that in this incident, most of the frozen assets were USDT and USDC, and the attackers were exchanging the remaining assets for ETH and other non-freezable assets.

This struggle also highlights the danger of considering cryptocurrencies as a single entity. The response after an incident differs between assets where the issuer can be involved in freezing and those that cannot be treated the same way.

The FBI is seeking cooperation not only from exchanges but also from DeFi services and blockchain analysis companies because the funds move through multiple routes. There remains a gap between being able to track and actually recovering the assets.

Reactions Confirmed on Social Media—Management Emphasized "Customer Protection"

In this incident, social media has also become a platform for communicating the company's crisis response.

However, it is important to distinguish between the posts of confirmed stakeholders and the opinions of the general user base. Here, we cover the posts on X that have been verified by reports. It is not a comprehensive survey of general user reactions.

Binance Co-CEO Richard Teng communicated the progress of the replenishment.

According to Reuters, Teng indicated on October 31 on X that 90% of the stolen assets had been replenished and that the remainder would also be covered. This directly conveyed the company's stance of not imposing financial burdens on users from the top management.

Founder Changpeng Zhao also mentioned compensation for customers.

In the initial reactions reported by AP, Zhao stated that the incident appeared to be a hacking and expressed the outlook that customers would be fully compensated. At the same time, he noted that he is not currently involved in the company's management.

While the founder's statements tend to attract attention, they cannot be treated the same as formal recovery reports by the current management.

Binance's official account explained that the attack was complex.

According to AFP, the company posted on X that it is responding in cooperation with investigative agencies. Whether a single terminal breach can explain the situation or if there was a broader problem is a focus of the investigation.

These communications suggest that the management is in a hurry to explain "who will bear the losses." However, for users, it is also important to know "when they can move their assets" and "whether the same thing will happen again."

Because this is a situation where reassurance is sought, short posts on social media need to be read in conjunction with official progress reports and subsequent technical reports.

Resuming Withdrawals and Confirming Safety Are Separate Challenges

According to reports from France-Antilles and Reuters, Binance indicated plans to resume withdrawals on Sunday, November 1.

However, the announcement of a resumption plan does not equate to the ability to actually withdraw all assets. The recovery of services involves not only securing assets but also checking safety.

Even if a balance is displayed on the account screen, if transfers are halted, users cannot move those assets elsewhere. "Having a balance," "having the underlying assets," and "being able to withdraw when needed" are related but separate confirmation items.

The trust questioned in this incident cannot be measured by a single figure like the replenishment rate. The actual withdrawal situation and explanations about the cause of the attack will be future judgment materials.

Three Points Japanese Readers Should Consider

When reading this news from Japan, the first thing to avoid is judging the impact on the services you use based solely on the name "Binance."

Based only on the confirmed information, it cannot be concluded that the same damage or withdrawal restrictions have occurred in services for Japan. It is necessary to check the official announcements that specify the scope of the services and contracts you use.

The following three points will be particularly important in future announcements.

• Status of Replenishment Completion: How far the policy to cover the shortfall has been actually implemented.
• Status of Withdrawal Implementation: Not just the resumption schedule, but also the status of the target assets and restrictions.
• Causes and Measures to Prevent Recurrence: How specifically the issues of entry routes and authority management are explained.

These are issues separate from the rise and fall of cryptocurrency prices. Even if prices recover, it does not automatically prove the safety of the service.

Massive Replenishment Alone Does Not End Trust Recovery

This incident highlights the reality that even a giant exchange is not immune to cyberattack damage.

Addressing customer losses is important. However, questions remain about why unauthorized asset transfers could not be prevented, how far the impact extended, and what mechanisms will prevent recurrence.

The investigation into the stolen assets and the work to restore a state where users can use the service with peace of mind proceed in parallel.

The figure "90% replenishment" is one milestone in that process. The success of trust recovery will be judged by the remaining replenishment, actual withdrawals, and the accumulation of verifiable explanations.

Sources and References

1. France-Antilles:
   Attribution to North Korea by the FBI, scale of damage, and Binance's response.
   https://www.guadeloupe.franceantilles.fr/actualite/international/le-fbi-accuse-la-coree-du-nord-du-casse-du-siecle-chez-binance-1098200.php

2. FBI: Official announcement on October 31, 2026.
   Attribution to North Korea and TraderTraitor, exchange to ETH, warning of money laundering, and request for cooperation to block transactions.
   https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attackFBI

3. Binance: Official update on the security incident.
   Amount of damage, policy to bear customer losses, investigation of entry points, and confirmation status regarding private keys.
   https://www.binance.com/en/square/post/382966610455230Binance Announcement on Binance Square

4. Reuters/GMA Coverage: About the 90% replenishment of stolen assets.
   Repurchase of assets using company funds, liquidity of remaining assets, Teng's post on X, and withdrawal resumption plans.
   https://www.gmanetwork.com/news/money/companies/1007874/binance-says-it-has-covered-90-of-losses-from-6-3-billion-hack-so-far/story/gmanetwork.com

5. AP News: Reporting at the time of the incident's discovery and the founder's reaction.
   Zhao's initial view and mention of customer compensation.
   https://apnews.com/article/39cda8ceb8095e036334a18549d3d20dapnews.com

6. AFP: Explanation on Binance's X.
   Communication that it was a complex attack and the course of investigation and response.
   https://www.afp.com/en/crypto-platform-binance-confirms-complex-63-bn-hackAFP.com

7. Elliptic: Analysis of the stolen assets' tracking.
   Breakdown of frozen assets and the movement of asset exchanges by the attackers.
   https://www.elliptic.co/insights/binance-largest-hack-in-history/Elliptic

8. FBI/IC3: Official announcement regarding the Bybit incident in 2025.
   Confirmation of the $1.5 billion damage and attribution to TraderTraitor as comparative material.
   https://www.ic3.gov/PSA/2025/PSA250226