What Did the FBI Say About the Binance Hack?

The attribution is now official. The FBI said TraderTraitor carried out the theft of more than $6 billion and that its members were observed converting the loot into ETH. The bureau published wallet addresses it links to the laundering and, together with the Secret Service and IRS criminal investigators, asked exchanges and services to block transactions touching them.

That moves the North Korea link beyond the private-sector assessment from TRM Labs, which had called it a high-confidence judgment days earlier. The FBI did not name individuals or explain how the attackers got into Binance’s systems.

What Happened on October 29?

The attack began around 20:05 UTC. According to SOCRadar’s timeline, Binance wallets across roughly 10 blockchains sent funds to attacker addresses within about 20 minutes. Binance puts the impact at about $6.3 billion, roughly four times the $1.5 billion Bybit theft in February 2025.

Plain-English version: exchanges keep most customer funds in offline “cold” storage and a smaller working balance in “hot” wallets that must be online to process withdrawals. The attackers got Binance’s own withdrawal system to approve transfers it should have refused. Binance says it found no evidence of a private key leak. On Ethereum, analysts say the attacker used EIP-7702, a feature that lets a normal account temporarily hand control to smart contract code, to sweep one hot wallet in a single transaction.

Binance first pointed to a compromised DevOps engineer’s laptop, then said its investigation had found additional points of breach. Co-CEO Richard Teng said the attack was not carried out by one person. The full root cause has not been published.

How Bad Was the Withdrawal Rush?

Less bad than feared, though not trivial. Binance’s own figures show net outflows of $3.64B in the first 9.5 hours, with volumes falling after an early spike. DefiLlama’s tracker briefly showed higher 24-hour net outflows, and the same report noted net inflows at OKX, Robinhood, and Bybit over that period.

Treat tracker numbers with care. Co-CEO Yi He said bots may be counting Binance’s new hot wallet addresses as outflows. Binance has not said how much of the tracked total is internal movement.

Who Is Paying for the Loss?

Binance says it, not its users, will bear the cost. It has set aside more than $6.34B in company funds, drawing on its SAFU insurance fund, part of its futures insurance fund, and its treasury, and plans to restore SAFU to about $1B.

The roughly $3B frozen on-chain is largely a stablecoin story. Tether and Circle froze about $1.8B within roughly 40 minutes of the main Ethereum sweep, and others froze smaller amounts. Stablecoin issuers can blacklist addresses, while ETH and BTC cannot be frozen once moved, which is why the FBI’s focus on ETH conversion matters.

What Is Still Unconfirmed?

Several things. Binance’s proof of reserves covers ten tokens (BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, ZEC) and checks backing, not whether the breach path is closed. One security analysis makes that point directly: recovery is not remediation.

“Inside job” claims are spreading on X, partly because of the delayed reserves report. The reporting there points to an outside attacker, and the FBI has now attributed the attack to a state-backed group. No evidence of insider involvement has been published. Separately, CoinDesk reported no proof of AI in how the hackers moved the funds through thousands of wallets.

Why It Matters

The hardware wallet failures earlier this year hit individuals. This one hit the infrastructure many of them trade through, and the exchange survived a $3.6B first-day exit without visible stress. That is reassuring about liquidity, but not about security. Until Binance explains how the attacker reached its signing path, the open question for the industry is the same one Bybit raised in February: how many exchanges have the same weakness.