The Binance hack started with a disclosure on Thursday, October 29, when the exchange said about $6.3 billion in digital assets had been taken. Two days later the FBI tied the theft to TraderTraitor, a North Korea-linked group, and Elliptic now puts the total at $6.43 billion. That is more than four times the $1.46 billion taken from Bybit in February 2025, which makes this the largest crypto theft on record.

For US readers, the attribution matters for two reasons. The FBI is driving the government response, and Binance's US affiliate is part of the picture. The reporting available to me does not spell out how Binance.US was affected, so that question stays open.

What the FBI says about TraderTraitor

On October 31 the FBI attributed the theft to TraderTraitor, a group also tracked as Jade Sleet and UNC4899, according to The Hacker News and Elliptic. The bureau acted alongside the U.S. Secret Service and IRS Criminal Investigation. In its statement, quoted by SecurityWeek, the FBI said it “has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH).”

Elliptic has said North Korea is likely behind the theft, and it links TraderTraitor to earlier major thefts, including Bybit and DMM Bitcoin. North Korea has denied involvement, according to Coin-Turk. The public case therefore rests on FBI findings and blockchain analysis, not on a full public account of how the intruders got in.

How the Binance breach unfolded

Here is the sequence as reported so far:

  • October 29: Binance discloses the breach and says about $6.3 billion in digital assets was taken.
  • October 30: 684.6 million TRX begin splitting from a single wallet, spreading to roughly 7,700 addresses.
  • October 31: The FBI attributes the theft to TraderTraitor and publishes more than 600 attacker-linked addresses.
  • November 1: Binance starts resuming withdrawals in phases.
  • November 2: Elliptic and TokenPost put frozen or seized funds at about $2.85 billion.
  • November 3: TRM Labs estimates about $2.7 billion frozen, with roughly $2.4 billion still under attacker control.

Binance has said the attack began after an engineer's laptop was compromised, as TokenPost reports. Other coverage describes malware delivered through a fake recruitment scheme. Business Standard reports that the attackers targeted engineers' devices and supplier tools, not the exchange's code.

That pattern extends well beyond one exchange. Attackers often do not need to break a hardened production system when a trusted employee or vendor will open the door. USA 24 has reported on a vendor breach that cost Crédit Mutuel Arkéa an estimated €118 million. Social engineering pays off too, as a $129 million AI CEO impersonation scam that led to three men being charged shows.

Where the stolen funds went

Elliptic reports that the funds were spread across 11 blockchains. Tron was the main laundering route, and FBI-linked reporting says the funds were mostly converted into Ether. The TRX split is the clearest sign of automated movement: 684.6 million TRX left a single wallet and fanned out to roughly 7,700 addresses starting October 30.

Reporting says there was no evidence that AI agents chose the laundering transactions, although the process was automated. Some outlets have raised AI-hacking concerns, but that angle is not confirmed by the sources I reviewed.

The cash-out stage is where investigators have the best chance to act. TokenPost reports that stablecoin transfers and centralized cash-out services are where freezes are most likely. That puts US exchanges and stablecoin issuers at the center of recovery, because they are the points where a frozen balance can actually be stopped. The FBI's list of more than 600 addresses gives exchanges and analytics firms specific wallets to block and monitor, and the bureau asked the crypto industry to help stop laundering.

Frozen funds and the numbers that do not agree

The headline totals differ. Binance's early estimate was about $6.3 billion, while Elliptic's figure is $6.43 billion. Frozen-funds numbers also vary by source and date. Elliptic and TokenPost put frozen or seized funds at about $2.85 billion by November 2. TRM Labs, as reported by Coin-Turk, estimated about $2.7 billion frozen by November 3 and said about $2.4 billion remained under attacker control.

Those figures use different methods and cover different dates, so each one is a snapshot rather than a final tally. How much of the $2.4 billion will come back is unknown. Freezing funds is not the same as recovering them, and the reporting does not say how any returned money would be distributed.

What Binance has said about withdrawals and compensation

Binance resumed withdrawals in phases starting November 1, according to American Bazaar. The exchange said it had replenished roughly 90% of the lost assets, a figure Fox Business reported as about $6 billion in its coverage of the FBI statement. Coin-Turk reports that Binance said it would fully compensate users.

These are company statements. The sources do not include an independent check of the replenishment figure or the compensation plan, and details on timing have not been confirmed.

For US customers, the key open question is Binance.US. The reporting available does not establish whether Binance.US customers were affected. Until Binance.US or Binance addresses that directly, treat any claim either way with caution.

What US crypto holders should do now

Start with the official source. Check withdrawal status only in the Binance app or on its official website, not in social media posts or direct messages from people claiming to speak for the exchange. These steps are general security advice, not recommendations drawn from the reporting:

  • Expect fake recovery and compensation offers. Scammers reliably follow big hacks with messages asking you to verify a wallet or pay a fee to get funds back.
  • Never share a seed phrase, private key or 2FA code with anyone, including someone who says they work for support.
  • Use an authenticator app or hardware security key instead of SMS codes wherever the option exists.
  • If you manage a team, treat engineer laptops, recruiter outreach and files from unfamiliar contractors as attack paths. Confirm any recruiter through the company's own channels before opening anything.

What comes next

Several signals will show whether this recovery holds up. Watch whether the frozen total rises beyond the November 2 and November 3 figures, and whether the FBI publishes more addresses. Watch whether Binance releases a compensation plan with dates and amounts that outside parties can verify, and whether Binance.US says anything about its customers.

Stablecoin issuers and cash-out services will largely decide how much of the $2.4 billion still in attacker hands is ever recovered. Business Standard framed the theft as part of rising nation-state attacks on crypto exchanges, and the coming weeks will test that framing. If the attackers reached a major exchange through its engineers and suppliers, other platforms should expect the same tactics.