# FBI ties Binance theft to North Korea's TraderTraitor > The FBI says North Korea's TraderTraitor stole more than $6 billion from Binance around Oct. 29. Binance says 90% of balances are refilled, and withdrawals reopened Sunday in phases. - **Source:** https://ptycoin.com/en/posts/2026-10-31-binance-fbi-tradertraitor-oct31/ - **Published:** 2026-10-31 - **Category:** News - **Author:** Mateo - **Tags:** exchanges, security, binance - **Also published in:** [Español](https://ptycoin.com/es/posts/2026-10-31-binance-fbi-tradertraitor-oct31/) --- According to an [FBI cyber alert](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack) posted Saturday, North Korea was responsible for the Binance theft of more than $6 billion in virtual assets, on or about 29 October. The bureau's name for that operation is TraderTraitor. Friday's public FBI comment, carried in [an earlier PTYcoin story](/en/posts/2026-10-30-binance-fbi-fca-oct30/), said the bureau was aware of the incident and named no attacker. Saturday's alert is the first public attribution from the US government. [Chainalysis](https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/) had already assessed the theft as the work of TraderTraitor. [Yonhap](https://en.yna.co.kr/view/AEN20261101000300315) reported that TRM Labs had reached a similar conclusion before the FBI notice. With the US Secret Service and IRS Criminal Investigation, the FBI says it has watched the actors it names turn most of the stolen coins into ether. The alert says a further round of laundering is expected after that, using decentralized-finance tools, software that swaps and lends coins without a company in the middle, and instant-swap services, which trade one token for another on the spot. It asks THORNode operators, RPC node operators (the servers apps query to read a blockchain), instant exchanges, those DeFi services, analytics firms, and other virtual-asset businesses to block transfers that touch addresses on a list in the alert. [TokenPost](https://www.tokenpost.com/news/investing/45594) counted roughly 525,200 ether in wallets it links to the attacker at 12:51 p.m. Eastern on Saturday, about $3.1 billion. About 200,600 of that ether came straight out of Binance, it said, and swaps supplied the rest. At that hour, none of it had moved to an exchange deposit address or a mixer, a service that blends coins so the path is harder to follow. TokenPost says labels of this kind can be incomplete or wrong. The tally sits apart from the coins Binance has been buying to restock customer accounts. In its [Saturday notice](https://www.binance.com/en/support/announcement/detail/1fdf1f61559c401da0435895ffcccb62), Binance said newly purchased coins now match 90% of Thursday's loss. A day earlier the matched share was near 80%. The ten with full backing are bitcoin and ether, Tether USDT, BNB, solana, USDC from Circle, XRP, USD1, RLUSD, and ZEC. Buying goes on in the open market and in OTC trades, private deals made away from the public book, until each affected token is matched. Coins outside that list make up the unmatched tenth. Binance said they trade thinly, so the amounts still wanted may take longer to find. Partners at other companies are helping line up the remaining buys, and Binance said further updates will come as that work continues. The bill, Binance said, stays with the company. The 90% is Binance buying coins so the balances customers see have assets behind them again. [CNBC](https://www.cnbc.com/2026/10/31/binance-hack-asset-coverage-withdrawals.html) reported that figure as a refill of customer backing, separate from coins the attacker still holds. Three pools fund the refill, the notice says. Part of SAFU, the Secure Asset Fund for Users, a reserve Binance opened in July 2018 for emergencies, is expected to move within a day toward tokens still short of a full match. The notice points to a public balance for that fund. Part of the futures insurance fund moved too. That pot is Binance's money, walled off from customer balances. The point of the cushion is to keep a busted futures position from being pushed onto other traders. What left the fund, Binance said, was extra above the minimum its risk rules demand, and the fund is still over that minimum. If the fund later drops under that minimum, Binance said it puts company money back in when required. Treasury cash is still paying for tokens the other two pools do not finish. Binance said it will restore SAFU to about $1 billion. Binance has posted a fresh reserves cut on its reserves site, dated midnight UTC on 31 October. In that kind of proof, coins the venue holds are set beside what customers are owed. The long zero-knowledge file, which lets you test your own credit against the lineup without opening someone else's account, needs roughly 40 to 50 hours of computing before it is done. Binance expects the file on Tuesday, 3 November, in UTC. A holder of any fully matched token can then look for at least one coin in custody per coin the account shows. Binance reopened withdrawals on Sunday, 1 November, in phases. [CNBC](https://www.cnbc.com/2026/10/31/binance-hack-asset-coverage-withdrawals.html) reported the restart, and Binance said on [X](https://x.com/binance/status/2116777408074600621) that the first batch network opened in phase one was the bitcoin network, with Ethereum and BNB Smart Chain following. More networks come back as security checks finish. --- ## Keep reading - [Is SMS 2FA enough to protect your crypto exchange account? The text code follows your phone number, and a SIM swap or port-out can move that number before the authenticator app, the withdrawal allowlist, and the anti-phishing code are on](https://ptycoin.com/en/posts/2026-10-27-exchange-account-2fa-withdrawal-allowlist/index.md): SMS codes follow the phone number, so a SIM swap can take them. Switch to an authenticator or a passkey, turn on a withdrawal allowlist, and set an anti-phishing code. - [What is a destination tag or memo? On XRP, Stellar, Cosmos and similar networks the receive address alone is not enough, and a missing or wrong tag is how exchange deposits look confirmed on-chain while the desk never credits you](https://ptycoin.com/en/posts/2026-09-22-destination-tag-memo-exchange-deposit/index.md): Your exchange deposit needs both address and destination tag or memo. Miss either and the chain can confirm while your balance never updates. Copy both, check twice, then send. - [Self-Custody 101: Moving Your Crypto Off an Exchange Safely](https://ptycoin.com/en/posts/2026-06-05-self-custody-101-moving-crypto-off-exchange/index.md): Take control of your cryptocurrency. This step-by-step guide shows beginners how to safely move crypto from an exchange into a hardware wallet you control, with concrete checks that prevent the most common — and costly — mistakes. --- Source: PTYcoin — https://ptycoin.com/en/posts/2026-10-31-binance-fbi-tradertraitor-oct31/. Free to read and cite with attribution to ptycoin.com. AI-usage terms: https://ptycoin.com/en/ai-usage/