- CZ thanked the FBI, U.S. Secret Service and other federal agencies for helping track and freeze funds stolen in Binance’s $6.3 billion hack.
- The FBI linked the attack to North Korea’s TraderTraitor hacking group.
- The U.S. Secret Service confirmed its investigators helped freeze a significant portion of the stolen assets.
Binance co-founder Changpeng Zhao has credited U.S. law enforcement agencies, including the FBI, Secret Service and Internal Revenue Service, for helping track and freeze funds stolen in the exchange’s $6.3 billion security breach.
The Binance Hack Breakdown: How Attackers Breached the Exchange and Moved the Stolen Funds
In a November 2 post on X, Zhao praised investigators for their quick response, saying they acted within minutes of the October 29 attack. He credited their speed and cooperation with helping contain the damage and reducing the risk of wider disruption across the cryptocurrency industry and financial markets.
Thank you, @SecretService, and all the agencies and industry partners involved. You acted within minutes to help track and freeze stolen funds, and the work continues. Your speed, expertise, and dedication helped contain the damage and reduce the risk of potential ripple effects across crypto and, may I say, even the broader financial markets. Deeply grateful. 🙏🙏🙏🙏
— CZ 🔶 BNB (@cz_binance) November 1, 2026
Zhao also responded to the FBI’s announcement that North Korea was responsible for the attack. He said the agencies provided important assistance in tracing and freezing the stolen cryptocurrency.
The comments followed an announcement from the U.S. Secret Service, which confirmed that its investigators had joined the effort to track the stolen funds.
The attack took place on October 29, when hackers compromised Binance’s internet-connected hot wallets and stole approximately $6.3 billion in digital assets. Binance said the incident involved unauthorized withdrawals and that its investigation had uncovered multiple points of breach. The exchange has not found evidence that wallet private keys were leaked.
FBI Links Binance Attack to North Korea
The FBI formally attributed the theft to North Korea’s state-sponsored hacking operation known as TraderTraitor in an alert published on October 31.
According to the agency, the attackers began converting the stolen assets primarily into Ethereum. The FBI, working with the U.S. Secret Service and IRS Criminal Investigation, warned that the funds could be moved through decentralized finance platforms and instant swap services to make further tracking difficult.
The FBI is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor." The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages. How You Can Help: FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets. A list of addresses associated with this activity is available here: https://t.co/g0oIWx0WeD
— FBI Cyber Branch (@FBICyberBranch) October 31, 2026
Binance previously reported that approximately $3 billion in affected assets had been frozen on-chain through cooperation with law enforcement agencies, blockchain intelligence firms, token issuers and other industry participants. The exchange said it would cover the financial impact of the theft using its Secure Asset Fund for Users (SAFU) and corporate funds.
The recovery effort has continued alongside the restoration of exchange services. Binance said on November 1 that it had replaced 90% of the stolen assets using company funds. Reuters reported on November 2 that the figure had reached approximately 95%, with the remaining tokens taking longer to source because of lower liquidity.
Meanwhile, Binance has also resumed withdrawals in phases. The resumption of withdrawals also led to a significant movement of funds from the exchange. Binance reported $3.64 billion in net outflows between 06:00 and 15:30 UTC on November 1, after processing $4.649 billion in withdrawals and receiving $1.01 billion in deposits.
The net outflow represented 2.1% of Binance’s total assets under management, which stood at $171 billion based on its October 28 Proof of Reserves data. The exchange said withdrawal volumes had declined after an initial surge and were beginning to stabilize, while deposits remained substantial.
