Skip to content
Sunday, 1 November 2026Threat Detection & DefenceCyber SafetyIdentity & AccessDevices & IoTCloud Security
Wire
01Trojanised Claude Code Extension Sat on Cursor's Marketplace for 11 Hours With an SSH Backdoor02Malaysia Airlines Warns Customers Their Data May Be Exposed in the Amadeus Reservation Breach03From 2 November, Singapore Police Call From One Number, 6000 0999, to Fight Impersonation Scams04FBI Names North Korea's TraderTraitor for the $6.3 Billion Binance Hack as Withdrawals Resume
NewsThreat Detection & Defence

FBI Names North Korea's TraderTraitor for the $6.3 Billion Binance Hack as Withdrawals Resume

The FBI has attributed the Binance theft to North Korea's TraderTraitor. Binance reopened withdrawals in phases on 1 November, starting with Bitcoin; the full proof of reserves is now due on 3 November.

Cybersecurity ASEAN editors · 1 min read
FBI Names North Korea's TraderTraitor for the $6.3 Billion Binance Hack as Withdrawals Resume

The FBI has attributed the theft of about $6.3 billion from Binance to TraderTraitor, a North Korean hacking group, NBC News reports, confirming the attribution TRM Labs and Chainalysis made on 30 October. Binance began letting customers withdraw again on 1 November, starting with Bitcoin and adding networks in phases.

The FBI, the Secret Service and the IRS's criminal investigators asked exchanges and other services to block the attacker's published addresses, and the FBI said it expects "further laundering" of the stolen funds.

Withdrawals and reserves

Binance said "Restoring access to user funds is a priority, and we are taking a controlled approach to do so safely". After Bitcoin, Ethereum and BNB Smart Chain followed the same day, with other networks to come in phases.

It has said that "These losses will not be passed on to users", and NBC reports it set aside about $6.34 billion of company funds to cover them. The full proof of reserves Binance's chief executive promised for 2 November has moved: the computation takes 40 to 50 hours and is now expected on 3 November UTC, Tech-ish reports, citing Binance.

Where the money is

Elliptic has verified $2.85 billion of frozen or seized funds, almost all of it stablecoins that their issuers could lock. By Elliptic's count the attacker still controls about $3.25 billion that no issuer can freeze, spread over more than 800 addresses.

The laundering so far runs through decentralised exchanges and bridges. Elliptic traced USDT swapped into ETH through Uniswap, 1inch and market makers' quote systems at losses of 12 to 26%, and TRX sent across at least six cross-chain bridges.

Arbitrum and Optimism have secured everything stolen on their networks.

In Singapore

Binance.com remains on the Monetary Authority of Singapore's Investor Alert List, The Star reported, citing The Straits Times. How the attackers got in is covered in the earlier report on the engineer's laptop and the analysts' attribution.

More news