• Analysis
Binance withdrawals resumed, but Trump questions North Korea link to hack
Binance said on Sunday it had resumed withdrawals suspended after a major hack, as US President Donald Trump cast doubt late Saturday on whether North Korea, blamed by the FBI, was behind the theft of $6.3 billion in tokens.
Trump's doubt in Florida
While the FBI pointed to Pyongyang, US President Donald Trump told reporters late Saturday at his residence in Florida that he was not worried by the attribution. "I'm not concerned. We're learning about it. We don't know if it's North Korea," Trump said.
Trump has often reflected with pride on the summits he held with North Korean leader Kim Jong Un during his first term.
"I'm not concerned. We're learning about it. We don't know if it's North Korea"
FBI points to TraderTraitor
The FBI said on Saturday that North Korea was responsible for stealing more than $6 billion in virtual assets from Binance, the world's largest crypto exchange by daily trading volumes, on or about October 29, 2026.
The bureau confirmed suspicions that a Pyongyang-affiliated group called TraderTraitor was behind the binance hack, and said it had observed TraderTraitor actors converting stolen assets into Ethereum, with further laundering expected through decentralized finance and instant swap services.
The FBI urged private sector entities to:
- •Block transactions with addresses TraderTraitor actors are using
- •Block transactions derived from those addresses
The theft is described as the world's largest digital heist, part of a north korea crypto theft pattern officials link to funding for weapons programs.
Withdrawals restart on bitcoin network
Binance said on Sunday that the binance hack withdrawals had begun again, announcing on X that the first phase opened on the bitcoin network. The exchange had earlier said it was preparing to resume the first phase between 0600 and 0900 GMT on Sunday.
According to Binance, tokens were prioritized based on the past week's data of user demand, with each network and asset pair restored carefully alongside stability and security checks.
Who pays for the loss
Binance said on Saturday it had set aside more than $6.34 billion in company funds to cover the losses, and said it covered 95% of the $6.3 billion in tokens stolen from its platform.
"Binance will absorb the financial impact of the stolen funds, not our users," the exchange said.
News of the cyberattack had caused the prices of most major cryptocurrencies to fall sharply on Friday.
As of Sunday, the phased resumption of withdrawals was under way, while the FBI urged private sector entities to block transactions tied to TraderTraitor addresses.
