FBI ties record $6.3B Binance hack to North Korea as withdrawals reopen

Binance's initial investigation suggested the breach involved a compromised DevOps engineer's laptop, which let the attacker reach a service container and submit unauthorized withdrawals. The exchange said it found no evidence of a wallet private key leak[1]. Co-CEO Richard Teng later said the attacker "did not simply use one engineer's permissions," and Binance described further points of breach in what it called a complex attack[5]. Unchained, citing TRM Labs, reports most of the money left Binance's hot wallets within about 20 minutes[5].

Binance suspended withdrawals, revoked the affected address authorisation and brought in law enforcement and blockchain intelligence firms. It has promised a detailed technical post-mortem once the investigation is complete[1].

Binance says about $3 billion of the affected assets has been frozen on-chain with help from partners[1]. Tether says it froze more than $1.5 billion in USDT within 30 minutes of the attack[3], and Circle told CNBC it has frozen more than $1.1 billion in USDC, up from the $800 million figure CEO Jeremy Allaire first gave[4]. Arbitrum's Security Council also moved assets out of an address tied to the exploit[5].

Binance began restoring withdrawals in phases at 6 a.m. UTC on November 1. Between then and 3:30 p.m. UTC it processed $4.65 billion in withdrawals and $1.01 billion in deposits, a net outflow of $3.64 billion, or 2.1% of its $171 billion in total assets[4]. The exchange says it will absorb the loss rather than pass it to users, and that it had covered about 95% of the impacted amount by November 1. The remaining 5% sits in less liquid tokens that take longer to source[4].

On November 2 Binance finished a zero-knowledge proof for its October 31 reserves snapshot. It covers BNB, BTC, ETH, RLUSD, SOL, USD1, USDC, USDT, XRP and ZEC, and shows customer balances in those tokens are backed at least 1:1. A Merkle tree lets each user confirm their account was counted, while a zk-SNARK proves total reserves cover what users are owed without revealing anyone's balance[5]. A wider snapshot covering more tokens is planned for November 4[5].

The attackers did not need private keys. They reached the systems that approve and send withdrawals, which is a harder problem than key storage for every large exchange running automated hot wallets. The fast freezes also show how much of the recovery now depends on centralised stablecoin issuers being able to lock tokens on-chain within minutes[3][4].