TLDR:The FBI attributes the theft of more than $6 billion from Binance to North Korea’s TraderTraitor group.TraderTraitor actors are converting the stolen assets mainly into Ethereum for further laundering. Binance covered the losses with $6.34 billion from its own funds and is absorbing all related costs. Withdrawals resumed in phases from November 1, with a full proof of reserves planned by November 3. The Binance hack, involving more than $6 billion in virtual assets, has been attributed to North Korea by the FBI. The agency says the theft took place on or about October 29, 2026. It links the attack to a North Korean group called TraderTraitor. The Secret Service and IRS Criminal Investigation are working with the FBI on the case. Investigators are already tracking how the stolen funds are moving across the market.How the Stolen Funds Are MovingAccording to the FBI, TraderTraitor actors are converting the stolen assets mainly into Ethereum. Officials expect the group to move the funds through DeFi platforms and instant swap services. These steps would prepare the assets for later stages of laundering. The FBI and its partners have observed this conversion process.The FBI, the Secret Service, and IRS Criminal Investigation have issued a call to the private sector. Specifically, they are urging THORNode operators, RPC node operators, and instant exchanges to take action. DeFi services, blockchain analytics firms, and other virtual asset service providers received the same request. The notice is addressed to private sector entities across the virtual asset industry.The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North… pic.twitter.com/TBUvUFln4n— FBI Cyber Branch (@FBICyberBranch) October 31, 2026The request asks them to block transactions with, or derived from, addresses used by TraderTraitor. Additionally, the FBI published a full list of addresses that hold or have held assets from the Binance hack. Those addresses are operated by, or closely connected to, the North Korean actors. The full list appears in the FBI notice for reference.Anyone with information is asked to contact a local FBI field office. The Internet Crime Complaint Center also accepts reports through ic3.gov. The FBI says it remains committed to disrupting North Korea’s illicit cybercrime and asset theft activities. The agency also encourages the virtual asset community to share relevant information.Binance Covers Losses and Resumes WithdrawalsAfter the Binance hack, the exchange moved quickly to cover losses using $6.34 billion from its funds. It fully backed major assets such as Bitcoin and Ethereum. It also acquired less liquid tokens during the process. Less liquid tokens are assets that are harder to sell quickly in the market.Withdrawals began resuming in phases on November 1. Binance is absorbing all costs related to the incident. As a result, the company, not its users, is carrying the financial burden. These steps followed the exchange’s decision to cover the losses directly.Latest Withdrawal UpdateWithdrawals have now been re-enabled for the following networks and assets: BTC: BTC ETH: ETH, USDT, USDC BSC: BNB, USDT, USDC XRP: XRP Base: ETH, USDCWe will continue to restore additional assets and networks in phases as security… https://t.co/jSeeorSKGD— Binance (@binance) November 1, 2026Binance also plans to complete a full proof of reserves by November 3. This step follows the company’s move to back major assets fully. The timeline places the reserve review two days after withdrawals began resuming.Meanwhile, President Donald Trump said he is not concerned about the Binance hack. He added that he plans to talk to North Korea about the incident. The remarks follow the FBI’s attribution of the theft to a North Korean group.The post FBI Blames North Korea for $6 Billion Binance Hack as Exchange Covers Losses appeared first on Blockonomi.