Binance, the world's largest cryptocurrency exchange by daily trading volume, has resumed user withdrawals after a record-breaking hack that saw more than $6 billion (€5.38bn) in virtual assets stolen. The FBI has officially attributed the attack to North Korea, specifically a state-linked group known as TraderTraitor.
The exchange suspended withdrawals on Friday following the breach, which sent shockwaves through the crypto market. Bitcoin fell nearly 5%, Ethereum dropped almost 6%, and Binance's native token BNB tumbled around 10% in the immediate aftermath.
On Sunday, Binance began restoring services in phases. Between 06:00 GMT and 15:30 GMT, the platform processed $4.65 billion (€4.17bn) in withdrawals and $1.01 billion (€905m) in deposits. The net outflow of $3.64 billion (€3.26bn) represents roughly 2.1% of the company's total managed assets.
FBI points to Pyongyang
The FBI released a statement on Saturday confirming that North Korea was responsible for the theft, which occurred on or about October 29, 2026. The bureau said it had observed TraderTraitor actors converting stolen assets into Ethereum and expected further laundering through decentralised finance platforms and instant swap services.
“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion (€5.38bn) in virtual assets from cryptocurrency exchange Binance,” the statement read. The FBI urged private sector entities to block transactions linked to addresses used by the group.
TraderTraitor is the same group blamed for a $1.5 billion (€1.34bn) theft from the Bybit platform in February last year. It is believed to be part of the Lazarus Group, which gained notoriety in 2014 for hacking Sony Pictures over the film The Interview.
US President Donald Trump, however, cast doubt on the attribution. “I'm not concerned. We're learning about it. We don't know if it's North Korea,” he told reporters at his Florida residence late on Saturday. Trump has often highlighted his summits with North Korean leader Kim Jong Un during his first term.
Binance pledges to cover losses
Binance has sought to reassure users, stating on X that it has set aside more than $6.34 billion (€5.68bn) in company funds to cover the losses. “Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the company said.
The exchange said it had used company funds to buy tokens to replenish 90% of the stolen assets. The remaining 10% are “less liquid, which means they may take longer to source in the required amounts.”
The scale of the heist has put a spotlight on North Korea's ability to generate illicit revenue despite extensive international sanctions over its nuclear and missile programmes. It also raises broader questions about the security of cryptocurrency platforms, especially as artificial intelligence models become more sophisticated and could potentially compromise cryptographic protocols.
For European regulators, the incident adds urgency to ongoing scrutiny of Binance's operations. The exchange has faced regulatory pressure across the continent, and EU regulators are already probing its use of legal loopholes to serve the bloc. The hack could accelerate calls for stricter oversight of the crypto sector, which remains a patchwork of national and EU-level rules.
As Binance works to restore full functionality, the broader crypto market remains on edge. The incident underscores the persistent vulnerabilities in digital asset infrastructure, even for the largest players. For now, the exchange's promise to cover losses may help stabilise user confidence, but the long-term reputational damage could be significant.
