UPDATE: Binance Resumes Phased Withdrawals After $6.3B Breach Attributed to TraderTraitor
CIE News ·
Update to UPDATE: Binance replenishes 90% of stolen funds with withdrawals set for Nov. 1
Preliminary statement from the organization involved; full details not yet released.
Binance has begun phased withdrawals following an investigation attributing its recent hack to North Korea's TraderTraitor, with $3 billion in stolen assets frozen by token issuers.
Binance has initiated phased customer withdrawals following an FBI investigation that tied its recent security incident to North Korean state-sponsored cyber unit TraderTraitor. As previously reported, the exchange moved to replenish 90% of the stolen assets after an October 29, 2026 exploit drained between $6.3 billion and $6.36 billion from its hot-wallet infrastructure.
Investigators determined that the attackers breached Binance's hot wallets using compromised internal signing flows alongside malicious EIP-7702 sweeper contracts. The FBI reported observing TraderTraitor swapping stolen crypto assets into Ethereum (ETH) and anticipates continued laundering efforts. Meanwhile, asset issuers have successfully frozen approximately $3 billion in affected stablecoins and wrapped tokens.
Binance confirmed that 10 major tokens—including Bitcoin (BTC), Ethereum (ETH), Tether (USDT), BNB, Solana (SOL), USD Coin (USDC), XRP, USD1, RLUSD, and Zcash (ZEC)—are now fully backed at a minimum 1:1 ratio. The exchange funded the repurchases through its corporate treasury, Futures Insurance Fund, and partial allocations from its $1 billion Secure Asset Fund for Users, and is sourcing less liquid tokens to bridge the remaining shortfall.
Key facts
- Attributed to TraderTraitor
- $3B in assets frozen
- Phased withdrawals resumed
- 10 major tokens 100% backed