tradertraitor binance: FBI Names North Korea, 95% Replaced

The tradertraitor binance link is now official. On Saturday, the FBI said North Korea's state-backed TraderTraitor unit was responsible for the roughly $6.3 billion theft from Binance, the largest crypto heist on record. Hours later, early on Sunday, Binance began a phased restart of withdrawals and said it had replenished about 95% of the stolen assets with its own money.

What actually happened

The attack hit Binance's hot wallets on October 29. Co-CEO Richard Teng first described a compromised engineer's laptop that let an attacker reach a service container, then later called it a "complex attack" involving malware built to delete evidence of its activity, according to a Reuters report carried by NBC News.

On Saturday, the FBI named the culprit. In a statement reported by NBC and CNBC, the bureau said members of the North Korean unit known as TraderTraitor had been observed converting the stolen tokens into ether, and that it expects "further laundering" of the assets. Blockchain analytics firm TRM Labs had pointed in the same direction earlier, telling CNBC that the attack matched past North Korea-linked heists, including Bybit and the April 2026 KelpDAO hack, with small Tornado Cash withdrawals funding an operator wallet and signatures prepared in advance, then executed in one burst.

Who TraderTraitor is

CNA, drawing on AFP reporting, describes TraderTraitor as a hacking operation tied to the broader Lazarus Group, the same network blamed for the 2014 Sony Pictures hack. The group's signature trick is social engineering. Its operatives pose as recruiters, send a fake pre-employment coding test and use it to plant malware on a target's machine.

That is how the FBI says the group hit Japan's DMM Bitcoin for about $308 million in 2024. The bureau also linked TraderTraitor to nearly $200 million stolen from Atomic Wallet, Alphapo and CoinsPaid in 2023, and to the roughly $1.5 billion Bybit theft in February 2025. The tradertraitor binance attack is about four times the size of Bybit.

The pattern rarely changes: compromise a person first, then use that person's access to empty the wallets.

Binance's recovery so far

Binance says users will not bear the loss. On Saturday it reported covering about 90% of the stolen tokens, using part of its Secure Asset Fund for Users (SAFU), a portion of its futures insurance fund and corporate treasury, per CNBC. By early Sunday, Teng posted that the number had reached about 95%. The remaining 5% sits in less liquid tokens outside the top ten that take longer to buy in size.

The first withdrawal window covered BTC, ETH, BNB, SOL, XRP, DOGE, ZEC, TON, SUI and several stablecoin routes on networks such as Arbitrum, Base, Optimism, Polygon and Avalanche, according to TokenPost and Coinlive. Binance warned that traffic could cause delays or failed attempts early on.

For background, see our earlier coverage of the breach in binance 6.3b hack and the original restart plan in binance withdrawals sunday.

Why the attribution matters

Naming North Korea changes the recovery math. Funds routed through state-run laundering pipelines are hard to claw back, which makes Binance's self-funded replacement the main thing protecting users. It also raises pressure on other exchanges, mixers and bridges to freeze anything linked to the hack. Earlier reporting from The Block said industry partners including Tether, Circle and Ripple had already frozen around $3 billion tied to the incident. Those freezes, plus any assets seized later, are the only realistic path for money to come back from the tradertraitor binance wallets.

The tradertraitor binance case will likely shape policy talk in Washington this week, with US midterm elections on November 3 and crypto regulation already a campaign issue.

What to do as a reader

If you hold funds on Binance, check the official withdrawal and network status pages before moving anything, and expect some queues in the first phases. Use only the official app or site, and type the address yourself.

Watch for phishing. Hack headlines bring fake "refund" portals and impostor support accounts. Binance does not need your seed phrase or a wallet connection to cover its own losses.

Track the promised proof-of-reserves report and the post-incident write-up. Those will show whether the 95% figure holds and how the attacker actually got in. You can follow official updates on the Binance announcements page.

Nothing here is investment advice.