Binance $6.3B Hack: FBI Blames North Korea, SAFU Deployed

Binance’s emergency Bitcoin wallet held roughly half its pre-hack balance on Nov. 2 after the exchange tapped its Secure Asset Fund for Users (SAFU) to cover losses from Thursday’s reported $6.3 billion hack. Binance confirmed a transfer of 7,499 BTC on Saturday. By Monday, the wallet held approximately 7,500 BTC, worth $583 million, down from about 15,000 BTC before the transfer.

The exchange said it had replenished roughly 95% of affected assets, up from 90% a day earlier, and continued buying back remaining less-liquid tokens through market and over-the-counter transactions. Binance began reopening withdrawals in phases on Sunday, funding the recovery with its corporate treasury, SAFU and part of its futures insurance fund.

The FBI attributed the theft to North Korea on Saturday, referring to the malicious activity as TraderTraitor. Investigators said stolen assets were being converted primarily into Ether (ETH), with further laundering expected through decentralized finance platforms and instant-swap services. The bureau urged THORNode and RPC node operators, instant exchanges, DeFi providers and blockchain analytics firms to block transactions involving addresses linked to TraderTraitor actors.

The attack also prompted political reactions ahead of the Nov. 3 US midterm elections, with voting already under way in many jurisdictions. In the market snapshot accompanying the report, Bitcoin traded at $77,147.65, down 0.26%, while Solana fell 2.51% to $92.18 and HYPE declined 4.25% to $84.26.