- CZ expressed his gratitude to the FBI, the U.S. Secret Service, and other federal entities for their assistance in locating and freezing assets taken during the $6.3 billion Binance breach.
- The attack was formally attributed to the North Korean hacking collective TraderTraitor by the FBI.
- Investigators from the U.S. Secret Service verified that they played a role in successfully freezing a major portion of the compromised funds.
Changpeng Zhao, co-founder of Binance, has publicly thanked U.S. law enforcement organizations—including the Internal Revenue Service, the Secret Service, and the FBI—for their help in tracing and locking down funds stolen during the exchange’s $6.3 billion security incident.
The Binance Hack Breakdown: How Attackers Breached the Exchange and Moved the Stolen Funds
In a November 2 post on X, Zhao commended the rapid response of investigators, noting that they took action just minutes after the October 29 breach. He credited their expertise, speed, and collaborative efforts with limiting the overall harm and lowering the potential for cascading effects across financial markets and the broader crypto sector.
Thank you, @SecretService, and all the agencies and industry partners involved. You acted within minutes to help track and freeze stolen funds, and the work continues.
Your speed, expertise, and dedication helped contain the damage and reduce the risk of potential ripple effects across crypto and, may I say, even the broader financial markets.
Deeply grateful.— CZ
BNB (@cz_binance) November 1, 2026
Zhao also addressed the FBI’s determination that North Korea was behind the incident, acknowledging that the agencies delivered vital support in tracking down and freezing the cryptocurrency.
These statements followed an official release from the U.S. Secret Service confirming that its personnel had participated in the tracking operations for the missing assets.
The breach occurred on October 29 when perpetrators gained access to Binance’s internet-connected hot wallets, making off with roughly $6.3 billion in digital currency. According to Binance, the event involved unauthorized withdrawals, and subsequent internal reviews revealed multiple entry points for the breach. The company noted it has uncovered no proof that private keys for the wallets were compromised.
FBI Links Binance Attack to North Korea
An advisory issued on October 31 by the FBI formally blamed North Korea’s state-backed hacking group, TraderTraitor, for executing the theft.
The bureau reported that the culprits started converting the stolen digital holdings primarily into Ethereum. Alongside IRS Criminal Investigation and the U.S. Secret Service, the FBI cautioned that these assets could traverse instant swap networks and decentralized finance (DeFi) platforms to obscure their trail.
The FBI is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."
The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.
How You Can Help:
FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.
A list of addresses associated with this activity is available here: https://t.co/g0oIWx0WeD— FBI Cyber Branch (@FBICyberBranch) October 31, 2026
Previously, Binance announced that roughly $3 billion worth of impacted tokens had been frozen on-chain via cooperative efforts among law enforcement, blockchain analysis companies, token creators, and industry allies. The exchange committed to absorbing the financial losses by utilizing its corporate reserves and the Secure Asset Fund for Users (SAFU).
Restoration work has moved forward alongside recovery procedures. Binance shared on November 1 that corporate funds had been used to replace 90% of the stolen holdings. A November 2 Reuters report indicated that this figure climbed to approximately 95%, with the remainder delayed due to lower market liquidity for those specific tokens.
Concurrently, Binance initiated a phased reopening of withdrawal channels. This restoration triggered substantial movement out of the platform, resulting in $3.64 billion in net outflows between 06:00 and 15:30 UTC on November 1, following $4.649 billion in processed withdrawals against $1.01 billion in incoming deposits.
The net outflow accounted for 2.1% of Binance’s total assets under management, which sat at $171 billion according to Proof of Reserves documentation from October 28. The company stated that withdrawal activity moderated after the initial surge, showing signs of stabilization while deposits remained robust.
Frequently Asked Questions
How much was stolen in the Binance hack?
Hackers stole approximately $6.3 billion in digital assets during the October 29 security breach.
Who was responsible for the Binance security breach?
The FBI formally attributed the cyberattack to TraderTraitor, a state-sponsored hacking group from North Korea.
Which law enforcement agencies assisted Binance?
U.S. law enforcement agencies, including the FBI, the U.S. Secret Service, and the Internal Revenue Service (IRS-CI), helped track and freeze the stolen funds.
How has Binance recovered the lost funds?
Binance used corporate funds and its Secure Asset Fund for Users (SAFU) to replace the stolen assets, reaching approximately 95% replacement by November 2, while law enforcement and industry partners helped freeze about $3 billion on-chain.
