North Korea Stole $6B From Binance. Now What?

The FBI has named TraderTraitor. Binance has reopened withdrawals. The launderers are already on the move.

By The crypto-money Desk

Binance reopened withdrawals in phases on Nov. 1, days after its record $6B+ hack, and users pulled a net $3.64B in the first nine hours. [1]

The exchange processed $4.65B in withdrawals against $1.01B in deposits, calling volumes "stabilising as expected." That net outflow, though striking, amounts to just 2.1% of Binance's stated $171B in assets. [1]

To shore up confidence, Binance published a new proof-of-reserves report — a cryptographic check users can run to confirm their balances are backed at least 1:1 — covering 10 tokens including BTC, ETH and USDT. The exchange says it has covered about 95% of the stolen amount, with the rest in less liquid tokens. [1]

On the attribution front, the FBI named North Korea's TraderTraitor group on Oct. 31, listed 628 addresses tied to the theft, and urged THORChain node operators, instant exchanges and DeFi services to block them. Chainalysis says the launderers moved $500M out of TRON wallets and have started shifting funds to Solana. [1]

Attribution without enforcement is a press release. The harder question is whether decentralised infrastructure — built precisely to resist censorship — can or will act fast enough to strand stolen funds before they disappear into the next chain.

Only the first 15 networks and assets are back online, with a second phase of withdrawals set for Tuesday. [1] The probe has a name. The money is still moving.

stabilising as expectedBinance