Trump Questions FBI's Assertion That North Korea Was Behind The $6.3 Billion Binance ...

The FBI attributed the $6.3 billion Binance theft to North Korea's TraderTraitor group, which also carried out the $1.5 billion Bybit hack in February 2025.

The FBI attributed the $6.3 billion Binance theft to North Korea's TraderTraitor group, which also carried out the $1.5 billion Bybit hack in February 2025.

TRM Labs says stablecoin issuers froze $2.7 billion of stolen funds, but roughly $2.4 billion remains beyond any issuer's reach.

TRM Labs says stablecoin issuers froze $2.7 billion of stolen funds, but roughly $2.4 billion remains beyond any issuer's reach.

BTCPay Server urged merchants to shut down servers immediately after unauthorized attackers swept hot wallets on versions 2.4.1 and older.

BTCPay Server urged merchants to shut down servers immediately after unauthorized attackers swept hot wallets on versions 2.4.1 and older.

It sounds nuts, but SoFi is giving new Active Invest users up to $1,000 in stock for a limited time, and all it takes is a $50 deposit to get started. See for yourself (Sponsor)

It sounds nuts, but SoFi is giving new Active Invest users up to $1,000 in stock for a limited time, and all it takes is a $50 deposit to get started. See for yourself (Sponsor)

The FBI said on Saturday, Oct. 31, that the record theft at Binance was linked to "malicious cyber activity" by North Korea's TraderTraitor group. The FBI says the same group carried out the $1.5 billion Bybit hack in February 2025. That night, reporters at a Halloween party at Mar-a-Lago asked President Trump the theft. He said: "I'm not concerned. We're learning it." He also said: "We don't know if it's North Korea." According to AP, he added that investigators could still determine that North Korea was responsible.

People with money on an exchange mostly need to know whether they will get it back. A day after the FBI statement, small businesses that accept Bitcoin (CRYPTO:BTC) received their own warning.

How Billions Left Binance in Minutes

Bernard Condon of the Associated Press reported that $6.3 billion in bitcoin and other digital currency was stolen from Binance on Thursday, Oct. 29. AP calls it the biggest crypto heist in history. The firms tracking the theft each have their own estimate. The attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, TRM Labs says. TRM Labs says most of it left in 20 minutes, starting at 20:05 UTC. Chainalysis said with "a high degree of confidence" that TraderTraitor was behind the $6.4 billion hack.

SoFi Active Invest is offering a limited-time promotion. Open an account, fund it with $50 or more, and you could receive up to $1,000 in complimentary stock for Active Invest accounts. See for yourself by clicking here now. (Sponsor)

Binance traced the breach to a DevOps engineer's compromised laptop. It said it found no evidence that a wallet private key had leaked. Co-CEO Richard Teng said: "To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action."

What Binance Customers Can Expect

Enough of the same digital currencies that were stolen have been set aside to cover 90% of the missing assets, according to Binance. It has promised to reimburse customers in full. That 90% is money Binance holds in reserve. Customers have not been paid back yet.

An earlier company statement said: "Binance will cover all losses from the SAFU fund and the company's funds. User funds are safe." Withdrawals resumed on Sunday, Nov. 1, in phases, according to Bloomberg. CNBC reported $3.64 billion in net outflows once withdrawals reopened. Bitcoin is holding near $77,803, down just 0.14% over 24 hours.

Where the Stolen Money Sits Now

TRM Labs says stablecoin issuers and Arbitrum's Security Council froze $2.7 billion of the stolen funds. The FBI says the group is converting most of what it took into ether, the native coin of Ethereum (CRYPTO:ETH). The bureau has asked exchanges and analytics firms to block transactions linked to the group's addresses. TRM Labs says the attacker now holds more than 420,000 ETH and 18,270 BTC. By TRM Labs' estimate, $2.4 billion of that is beyond the reach of any issuer.

Ari Redbord, chief policy officer at TRM, expects the money to be laundered through smaller exchanges over a period of months. "It's bank robbery, in this case, at the speed of the Internet," he said. He also said: "However, we can also track and trace those funds in real time in order to build investigations, to disrupt and to seize back funds."

BTCPay Server Merchants Told to Shut Down Now

The second alert is a separate incident. No source has linked it to the Binance theft. BTCPay Server is a free, open-source tool that businesses use to accept bitcoin payments. On Nov. 1, the project told users to switch off their servers: "We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers." A hot wallet holds the seed phrase needed to send coins on a server connected to the internet.

According to crypto.news, the project's Nov. 2 post said its investigation had found an attack method aimed at versions 2.4.1 or older. The post also said the project has no credible reports of funds drained on the latest release, 2.4.7. Nicolas Dorier, whom CoinDesk describes as BTCPay's founder, told CoinDesk that the reported thefts appear to involve versions older than 2.4.2. CoinDesk noted that the original closing call applied to every version.

Dorier said an attacker logged in as an administrator. The team does not yet know how the attacker got that access. All of the version guidance is preliminary.

The project's advice to merchants:

Holds servers shut down until the investigation ends.

Holds servers shut down until the investigation ends.

Update to the latest release.

Update to the latest release.

Holds only small balances in hot wallets and move the rest to cold storage, where private keys stay offline.

Holds only small balances in hot wallets and move the rest to cold storage, where private keys stay offline.

Open Questions Merchants and Exchange Users Face

BTCPay has not said how much was stolen, how many servers were hit or how many users have reported losses. It has not confirmed how the attack worked. On the Binance side, the thing to watch is whether the reimbursement covers the full loss or only the 90% Binance has set aside. Freezes have also stopped working on the $2.4 billion the attacker still controls. Recovering that money now depends on blocking the laundering as it happens.

Want Up To $3,000 In Stock? SoFi Is Giving New Active Invest Users Complimentary Stock

Looking to grow your money but unsure where to begin? SoFi Active Invest is offering a limited-time promotion; open a new Active Invest account, fund it with $50 or more, and you could receive up to $1,000 in complimentary stock .

editorial@247wallst.com for any questions or corrections.