North Korea denies FBI’s Binance-hack allegation as exchange reports normalized outflows

The facts

1. Binance spokesperson Ross O’Leary told TechCrunch the withdrawal suspensions were a precaution following a security incident. Binance said it was investigating reports of a potential security problem. ^[1]

2. Tether chief executive Paolo Ardoino said at 21:25 UTC on 29 October that his company had frozen more than 1.567 billion USDT linked to a potential Binance exchange hack. ^[2]

3. Circle chief executive Jeremy Allaire said at 21:18 UTC that more than 800 million USDC associated with the incident had been frozen in coordination with law enforcement. ^[3]

4. Binance put the estimated impact at about US$6.3 billion and said roughly US$3 billion had been frozen on-chain, AP reported from its public statements. These are provisional impact and freeze figures, not a final net-loss account. ^[6]

5. Binance initially said deposits and withdrawals were temporarily suspended during security checks. ABC obtained a statement confirming an attack and a commitment to cover losses. ^[5]

6. Binance's initial investigation identified a possible compromise of a DevOps engineer's laptop. It said it had found no evidence of a wallet-private-key leak; the root cause was not final. ^[8]

7. TRM Labs traced approximately US$6.36 billion in transfers from Binance-attributed wallets across ten blockchains, valued at the time of transfer. Its analysis covers observations through 00:30 UTC on 30 October and is a gross-outflow estimate, not verified unrecovered customer losses. ^[7]

8. Binance's assurances that users' funds are safe and losses will be covered remain company commitments. Freezing assets does not by itself establish their return to customers. ^[5]

9. Binance.US said its separate platform was unaffected, BBC reported. The incident concerns Binance.com. ^[9]

10. In a 30 October update reported by the BBC, Binance said its subsequent investigation had found additional breach points. Richard Teng said the attack was more complex than one employee's permissions or a single click, and that responsibility had not been attributed to any individual. ^[9]

11. Binance said it had reserved more than US$6.34 billion in company funds to cover the incident, including US$5 billion held in the affected token assets, The Verge reported on 30 October. Setting funds aside is a company commitment, not verification of completed customer repayments. ^[10]

12. In a later 30 October statement reported by the BBC, Binance said that deposits remain unaffected. The checked account does not establish general restoration of withdrawals, completed return of frozen assets or customer reimbursements. ^[11]

13. On October 31, Binance said it had replenished 90% of the affected assets, principally by purchasing replacement tokens using company funds. Replenishing its asset holdings is not recovery of 90% of the stolen funds or an independently audited reimbursement account. ^[12][13]

14. Binance said it planned on 31 October to restart withdrawals in phases on 1 November, subject to security checks. AFP reported on 1 November that the first Bitcoin network had reopened, and Reuters reported that Bitcoin withdrawals resumed; other networks were to follow in phases. ^{[12][13][15][16][17]}

15. The FBI’s 31 October notice attributes the theft of more than US$6 billion to North Korean TraderTraitor actors. On 3 November, North Korea’s Kim Yo Jong rejected the allegation in a statement reported by KCNA and Reuters. The allegation and denial are attributed positions, not an independently adjudicated finding. ^[14][4]

16. Reuters reported on 1 November that Binance said 95% of the tokens stolen in the estimated US$6.3 billion incident had been covered. This is a company-reported figure, not an independent audit or proof of completed customer reimbursement. ^[15]

17. Binance’s recovery update said the first withdrawal phase covered 15 assets and networks and that 95% of the affected amount had been covered; the exchange said the remaining 5% was illiquid. ^[17]

18. Reuters reported that customers withdrew more than US$3.5 billion net, citing DefiLlama; this is distinct from The Block’s narrower initial-window calculation. ^[18]

19. The Block calculated US$3.64 billion in net outflows over the first 9.5 hours from US$4.65 billion withdrawn and US$1.01 billion deposited, and reported that withdrawals later eased. ^[19]

20. Reuters reported that DeFiLlama measured US$4.72 billion in net outflows since withdrawals resumed as of Monday. In its 3 November report, Reuters also quoted co-CEO Richard Teng saying flows had normalized and 95% of affected tokens were replenished; those recovery figures are Binance claims. ^[20][4]