The FBI ended five days of speculation on Sunday: the $6.3 billion drained from Binance on October 29 was the work of North Korea. In a statement, the bureau attributed the theft to activity it calls "TraderTraitor", said it had observed the actors converting stolen assets primarily into Ethereum, and warned that the funds would next move through DeFi and instant swap services on their way to further laundering. It acted with the Secret Service and IRS Criminal Investigation.

The number is hard to absorb. Chainalysis put the haul at $5.9 billion at the time of theft — roughly four times the Bybit breach of 2025 — while Binance's own estimate is about $6.3 billion and Chainalysis chief executive Jonathan Levin has cited $6.4 billion. TRM Labs called it the largest crypto theft on record and attributed it to TraderTraitor with "high confidence".

Then came the containment. Binance says $3 billion has been frozen, a figure that grew through the week as Tether ($1.57B), Circle ($800M+), Ripple (RLUSD), World Liberty Financial ($27M in USD1), First Digital (FDUSD) and the Arbitrum Security Council ($30.5M) locked tokens. The exchange says it has set aside more than $6.34 billion of company funds, including $5 billion already held in the stolen tokens, and is buying the remainder over the counter and on exchanges to make reserves whole. Withdrawals, halted on October 29, reopened on Sunday; co-CEO Richard Teng had promised a proof-of-reserves report by Monday, and said roughly 90 percent of the stolen assets had been replenished.

How it happened is the part the industry should study. Binance's first account pointed at a compromised DevOps engineer's laptop that let an attacker reach a service container and submit unauthorised withdrawals — no private-key leak, the company said. By Thursday Teng described something more deliberate: the attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, a delegation that "did not pass through our normal approval controls", plus a self-destruct mechanism that destroyed tooling and traces. Investigators later found additional breach points. EIP-7702, Ethereum's smart-account upgrade, is not the cause — analysts told Cointelegraph the theft was possible without it — but it compressed many transactions into one sweep and handed defenders a new class of delegation to hunt for and revoke.

The laundering is equally unfamiliar. Chainalysis reported "never-seen-before" patterns: thousands of transactions in a short window, funds circulating among addresses and returning to wallets used earlier, consistent with automation. Onchain investigator ZachXBT found the Binance funds commingled via THORChain with proceeds of the earlier Bitget exploit, which was already attributed to TraderTraitor.

Markets took the hit immediately: bitcoin near $76,900, down 4.9 percent; BNB down 8 percent; ether down 5.7 percent; Aave and Uniswap tokens down double digits; the Fear and Greed index at 30, its lowest since August. Aave froze 175 reserves on V3 and 117 on V4 after the exploiter borrowed $44.6 million against stolen USDT, then lifted the freeze once the position stopped moving. Standard Chartered's Geoffrey Kendrick argued the obvious commercial consequence: the case for decentralised exchange just became easier to make.

What remains open matters more than what is settled. Whether the frozen $3 billion is recoverable or merely parked. Whether a proof-of-reserves snapshot answers the question depositors are actually asking — how a single delegation could move $6 billion past an exchange's controls. And whether "we will cover all losses" is a security control or a promise that the next exchange will also be able to keep.

Sources