Much of the money taken from Binance has not got away. Decrypt reported that $2.85 billion of the $6.43 billion stolen has been frozen or seized, compared with about 3% in the Bybit hack.
That is what separates this case from the usual pattern, in which stolen funds are long gone by the time anyone names a suspect. The attribution is the other half of the story: a US government agency has put a state behind one of the largest crypto thefts on record, and the state has denied it.
Key numbers
- $6.3 billion in digital assets taken from Binance in the Oct. 29 attack, the FBI's figure
- $2.85 billion frozen or seized, against about 3% of the funds in the Bybit hack, according to Decrypt
- 12,000 wallets used in the laundering, a new one about every 25 seconds
- $3.64 billion in net outflows from Binance in the first nine and a half hours after withdrawals reopened, or 2.1% of its assets
The FBI named the operation and asked others to block it
In an Oct. 31 security alert, the FBI attributed the Oct. 29 attack to North Korean cyber actors, CryptoSlate reported. The bureau refers to this activity as TraderTraitor.
According to Cointelegraph, the FBI said the stolen assets have mostly been converted into Ether, and that it expects them to be converted further through DeFi and instant swap services as the laundering moves to more advanced stages.
The agency asked private companies to cut the funds off: THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other digital asset service providers were urged to block transactions involving the addresses listed in its release. CoinDesk reported that the request covered Bitcoin, Ether and Solana addresses.
In plain words: stolen crypto is only useful once it can be swapped, bridged or cashed out, and those steps run through services operated by identifiable firms. When those operators refuse the flagged addresses, the coins stay traceable and hard to spend. That is why a law-enforcement alert reads like a list of wallet addresses rather than an arrest warrant.
The laundering is automated, and the reports stop short of calling it AI
Decrypt described the movement of funds as automated and spanning 12,000 wallets, at a pace of one new wallet about every 25 seconds. That volume is what analytics firms have been tracking since the theft.
It is also where the reports draw a line. CoinDesk reported that there is no proof artificial intelligence was used to move the stolen funds through thousands of wallets. Automation at speed is not the same as an AI system, and none of the reports I read presents evidence for the latter.
For scale, Cointelegraph cited a CertiK report attributing more than $2 billion of an estimated $3.4 billion in 2025 crypto security losses to North Korea-linked groups, across 79 of 656 documented incidents. The same research put thefts by those actors at an estimated $6.75 billion across 263 incidents between 2016 and early 2026.
Pyongyang rejects the attribution
North Korea has denied responsibility. The Defiant reported that Kim Yo Jong called the US accusation "absurd rhetoric," while Chainalysis said stolen funds had mixed with the proceeds of an earlier exploit.
The figures themselves are not uniform across the reports. The FBI's number is about $6.3 billion, CryptoSlate described the alert as covering more than $6 billion, and Decrypt used $6.43 billion. None of the reports explains the difference.
Binance reopened withdrawals and $3.64 billion left on day one
Binance kept Nov. 1 as its restart target and began phased withdrawals, Cointelegraph reported. In the first nine and a half hours after reopening, the exchange said it saw $3.64 billion in net outflows, equal to 2.1% of its assets, according to Decrypt.
The exchange described this as phase one. None of the reports gives a date for the later phases.