The leading cryptocurrency exchange, Binance, announced on Sunday the gradual resumption of withdrawals after a $6.3 billion hack. According to the FBI, North Korea is responsible for this heist of an unprecedented scale.
Published on: 01/11/2026 - 01:33 Modified on: 01/11/2026 - 09:49
After the spectacular cyberattack suffered by the Binance platform, some of its customers will be able to start making withdrawals again, the company announced on Sunday, November 1.
“The first round of withdrawals [...] is now open on the bitcoin network,” the company said on its official X account.
To display this X content (Twitter), it is necessary to authorize audience measurement and advertising cookies.
The platform, which suffered a massive heist of 5.6 billion euros on Thursday, October 29, had suspended withdrawals from its clients to stop the bleeding.
"User funds are safe. Binance will bear the financial impact of stolen funds, not our users," the platform promised. During their withdrawal operations, “users may experience temporary delays or longer processing times due to traffic volume,” she warned.
Binance, which is working to trace stolen assets with the help of other players in the cryptocurrency ecosystem, said it was buying assets corresponding to those that were siphoned and claimed on Saturday to have thus reconstituted "90%" of the stolen amount, while striving to collect the remaining 10%, "less liquid" assets, according to it.
North Korean hackers
The American federal police (FBI) claim to have identified, behind this unprecedented theft, the group of North Korean hackers known as TraderTraitor, and found that the thieves were converting the embezzled funds into Ether, the cryptocurrency of the Ethereum network.
Also read: Binance: why the cyber heist of the century has not yet revealed all its secrets
“It is intended that these assets will then be further laundered through conversions via DeFi services and instant exchanges, in order to prepare them for further laundering steps,” the FBI explained in a statement.
DeFi (decentralized finance) are financial services running on the blockchain. As for instant exchanges, they allow you to quickly convert one cryptocurrency into another without going through a bank or a traditional intermediary.
The FBI published a list of approximately 500 Ethereum addresses “that TraderTraitor actors are using to launder these stolen assets,” and asked cryptocurrency platforms, DeFi services and blockchain analysis companies to block transactions linked to these addresses.
US President Donald Trump, who regularly boasts of having good personal relations with North Korean leader Kim Jong-un, has expressed doubts about Pyongyang's involvement.
"I'm not worried. We're learning more. We don't know if it's North Korea," he told reporters at his Florida home late Saturday evening.
North Korean “Office 121”
The amount stolen represents four times what TraderTraitor had siphoned off, according to the FBI, from the ByBit platform in February 2025, i.e. $1.5 billion, at the time the largest theft in cryptocurrencies.
The scale of the Binance hack highlighted the ability of North Korea, hit by heavy international sanctions because of its nuclear and ballistic missile programs, to generate income illicitly.
The TraderTraitor group is considered part of the Lazarus group, itself affiliated with North Korean intelligence services. Lazarus became known in 2014 when he was accused of hacking Sony Pictures Entertainment studios in retaliation for the satirical film about North Korea "The Interview That Kills!"
According to a 2020 US military report, North Korea's cyberwarfare unit, "Office 121", has 6,000 employees who also operate from abroad, including Belarus, China, India, Malaysia and Russia.
The attack on Binance comes as many observers express concerns that the ever-expanding capabilities of artificial intelligence models could compromise cryptography and computer security protocols.
With AFP
Keywords associated with the article
The content you are trying to access does not exist or is no longer available.
