Binance Faces Massive Outflows Amid FBI Investigation Into North Korea’s Role in Record Heist
On November 2, 2026, the FBI issued a stark warning regarding the involvement of North Korea in the unprecedented $6 billion-plus heist targeting cryptocurrency exchange Binance. This revelation comes amid a significant withdrawal of funds from the platform, with users pulling out $3.6 billion in a matter of hours, a clear response to the alarming news.
The FBI’s investigation implicated the North Korean hacking group known as TraderTraitor, associating it with the recent theft that has now been dubbed the largest in cryptocurrency history. In an official alert published over the weekend, the bureau urged cryptocurrency service providers to block transactions associated with hundreds of addresses believed to be controlled by the hackers. This call to action occurs during a time when users are increasingly wary about the security of their assets on a platform that was once seen as the gold standard in the crypto exchange sector.
Jennifer Jun, an expert from Georgia Institute of Technology who closely follows North Korean cyber activities, noted that while attributing the theft to a nation-state is a significant aspect of cybersecurity, the immediate concern lies in implementing effective measures to mitigate the theft’s repercussions. Jun emphasized that the gravity of the situation serves as a catalyst for action, urging crypto exchanges and other stakeholders to respond promptly.
Ari Redbord, the global head of policy at TRM Labs, expressed the importance of the FBI’s attribution, suggesting that it lends credibility to actions taken against the perpetrators. By formally highlighting the attackers’ addresses, Redbord stated that exchanges, over-the-counter (OTC) desks, and stablecoin issuers were now equipped with the necessary information to freeze accounts linked to the hackers, potentially preventing swift liquidations of stolen funds. He highlighted the urgency of the situation, as funds can be transferred within minutes in the cryptocurrency market.
The FBI’s comprehensive alert, issued in collaboration with the U.S. Secret Service and IRS Criminal Investigation, specifically identifies 608 Ethereum addresses, 19 Bitcoin addresses, and a Solana address. It calls upon various stakeholders—including THORChain node operators, DeFi service providers, and blockchain analytics firms—to refrain from processing transactions derived from these addresses. Despite this, THORChain has been hesitant to acknowledge the bureau’s request publicly. Co-founders Chad Barraford and JP Thor expressed skepticism on social media regarding the efficacy of the notification, which they claim lacks novel information.
While stablecoin issuers responded more decisively this time compared to the Bybit incident, where the response was deemed sluggish, experts argue that halting the laundering of funds held in direct possession of the attackers poses a greater challenge. Many implicated services are decentralized finance (DeFi) platforms designed to minimize centralized decision-making. Jun indicated that cooperative consensus is vital to enact changes, a process that is typically set in motion between incidents rather than during an ongoing crisis.
In an interesting turn of events, Binance managed to resume withdrawals just two days after imposing a freeze. However, the extent of customer withdrawals was staggering—approximately $3.64 billion was extracted in the initial nine and a half hours following the news, representing around 2.1% of Binance’s total assets, which are valued at about $171 billion. In their efforts to mitigate the damage and restore client confidence, Binance reported that it had replenished approximately 95% of the stolen assets by leveraging its Secure Asset Fund for Users, a futures insurance fund, along with its corporate treasury.
Following the heist, the hackers quickly distributed the stolen assets across a staggering 12,000 wallets, conducting over 40,000 transactions within just four days—an average of one new wallet every 25 seconds. Elliptic, a blockchain analytics firm, estimated the total amount stolen to be around $6.43 billion, with nearly 44% of the funds—approximately $2.85 billion—having been frozen or seized so far. In a prior hack involving Bybit, only 3% of the stolen assets were similarly restrained.
Reports indicate the attack stemmed from a compromised DevOps engineer’s laptop, highlighting North Korea’s strategic focus on exploiting human vulnerability to achieve its objectives. Redbord noted that despite technological advancements, “one engineer, one laptop, one convincing message” can pave the way for significant breaches, underlining a pressing need for vigilance and improved cybersecurity measures.
The situation has prompted calls for the U.S. regulatory body to bolster collaborative strategies, especially after the Binance incident. Redbord stressed the necessity for more effective public-private information sharing, real-time cooperation with stablecoin issuers, and stringent security standards for any entity managing client funds.
Although the FBI has utilized a similar protocol following previous incidents to inform stakeholders and urge immediate action, the effectiveness of such measures remains uncertain. North Korea had successfully laundered nearly 499,000 stolen ether within ten days during the Bybit tragedy, primarily through exchanges for other cryptocurrencies—a feat that poses ongoing challenges for regulators and stakeholders in the crypto ecosystem.
As the investigation continues, the fallout from this infamous incident raises critical questions about the security of cryptocurrency exchanges and the efficacy of existing measures to protect users’ assets in an increasingly complex digital financial landscape.