Binance withdrawals due today as FBI names North Korea's TraderTraitor behind $6.3bn hack
The FBI has formally blamed North Korea and Binance says it has replaced 90% of the stolen crypto. When withdrawals return and what Pakistani users should do.
Binance says it is still on track to switch withdrawals back on today, Sunday, 1 November, three days after the biggest crypto theft on record froze customers’ money. What is new since our earlier report is that the FBI has now officially named the attacker: a North Korean state hacking unit it calls TraderTraitor.
What did the FBI say?
On Saturday, 31 October, the FBI, working with the US Secret Service and the tax agency’s criminal investigators (IRS-CI), said the theft on or around 29 October was carried out by TraderTraitor. That is the same North Korean group the bureau blamed for the $1.5 billion Bybit hack.
Until now the North Korea link came from blockchain investigators such as TRM Labs. A formal attribution by the FBI is a bigger step. The agencies said the hackers have been converting the stolen coins mainly into Ether, and they asked exchanges, node operators, analytics firms and other crypto services to block any transaction linked to the laundering addresses. They also warned of “further laundering”.
Has Binance paid the money back?
Mostly. Binance said on Saturday it had replaced 90% of the stolen assets by buying fresh tokens with its own money. The remaining 10% is in less liquid tokens that will take longer to buy.
The exchange said it had set aside about $6.34 billion to cover the loss, drawn from its $1 billion Secure Asset Fund for Users (SAFU), its futures insurance fund and its corporate treasury. Co-CEO Richard Teng said users “will not bear the financial impact of this incident.” Roughly $3 billion of the affected assets has been frozen on-chain, according to Binance’s own estimate.
Teng described a “complex attack” that began with a compromised laptop and used malicious software built to delete evidence and make tracing harder. Binance has not yet published a full report on how the attackers got in.
When exactly will withdrawals work?
Binance has said Sunday, but not an hour, and that withdrawals may come back in stages after final security checks. It has also taken a new proof-of-reserves snapshot, dated midnight GMT on Saturday, so holders of 10 listed tokens can check that their coins are backed at least one-to-one. Media reports say those results are expected on Monday, 2 November.
What this means for Pakistani users
Many Pakistanis hold crypto on Binance through P2P trades, even though the country’s rules for crypto trading are still being written by the Pakistan Virtual Assets Regulatory Authority (PVARA). A few practical points:
- Check the Binance app’s own announcements before trying to withdraw; a rush in the first hours can mean delays.
- Ignore anyone on WhatsApp or Telegram offering to “recover” or “unlock” your funds. Scammers follow every big hack.
- Do not send new money to an exchange until you have seen withdrawals work for your own account.
This is information, not investment advice. The next thing to watch is Monday’s proof-of-reserves result and whether the last 10% of stolen tokens is replaced.
