FBI Attributes Binance Theft to North Korea — What Is Known, What Remains Unclear, and What It Means for Europe

The Federal Bureau of Investigation (FBI) has attributed the attack on Binance to North Korea, in which cryptocurrencies worth approximately 6.3 billion dollars were taken, naming the group TraderTraitor as the perpetrator.

For European users, the practical question is not who stole the funds, but who bears the loss and how quickly the funds can be withdrawn. The available information suggests that, in the short term, customers are not losing their balances. The cost may, however, shift to slower withdrawals, additional checks and heightened attention from regulators. The recovery figures published so far, however, are not consistent with one another.

What has been officially established and what remains a statement

The FBI's attribution targets the group TraderTraitor, associated with the Pyongyang regime, according to Mediafax. The same group was also linked to the theft of 1.5 billion dollars from Bybit in 2025, and the Secret Service is also involved in the investigation. The repeated pattern strengthens the credibility of the North Korean lead. Nevertheless, an attribution by an investigative agency remains a technical and political conclusion, not a court judgment.

The reported modus operandi includes false job interviews and the compromise of an internal artificial intelligence tool. This detail matters for the entire industry. The breach does not appear to have originated from a cryptographic vulnerability, but from social engineering applied to employees and from internal tools with privileged access. The available sources do not, however, specify which exact systems were compromised, nor how the investigation was triggered.

The direct injured party is Binance. Clients are exposed only to the extent that the platform does not fully cover the loss. For this reason, the recovery figures are more relevant to users than the identity of the attackers.

Pyongyang denies, Washington sends different messages

Kim Yo-jong, the sister of the North Korean leader, rejected the accusations in a statement broadcast by the KCNA news agency. She described the FBI's claims as a "grave political provocation". The denial follows Pyongyang's consistent line regarding the cyberattacks attributed to it. It offers no elements that contradict the technical conclusions of the American investigators.

On the same day, according to Euronews, North Korea carried out missile tests. The simultaneity is a fact. The sources do not, however, document an intentional link between the two events, and such an interpretation would remain speculative.

In Washington, the message is not unified. President Donald Trump stated that the authorities are not yet sure who is behind the operation. The statement introduces political ambiguity. However, it does not constitute a formal refutation of the FBI's attribution, nor does it present alternative evidence.

The mechanism: from the internal breach to client behaviour

The causal chain can be reconstructed in three links. The first is the cause: access to internal systems, obtained through false interviews and a compromised AI tool. The second is the exploitation mechanism: the stolen funds must be laundered through conversions and fragmentation across wallets. Ari Redbord, of TRM Labs, estimates that this process may take several months. This time window allows part of the assets to be frozen.

The third link is the effect on clients. After the attack, users withdrew 3.64 billion dollars, that is 2.1% of the platform's assets. As an order of magnitude, the outflows indicate caution, not a widespread flight from the platform. Their pace in the following weeks will show whether confidence is stabilising.

The most uncertain link is recovery. Binance initially communicated that it had covered 90% of the losses. Subsequently, in the preliminary report of 3 November, the company announced the recovery of 98% of the affected tokens from the attack of 29 October. The terms "covered" and "recovered" are not equivalent. The first may mean compensation from the company's own reserves, the second the actual return of the assets. The difference between the two figures is not explained in the available sources.

The counter-hypothesis is that the withdrawals reflect an ordinary rebalancing of portfolios following an operational disruption, rather than a lack of confidence in the platform. This is less plausible as a complete explanation, because the outflows immediately followed the attack and were concentrated on the platform that was hit. Public data, however, do not permit a strict separation of the two effects.

What it means for users and exchanges in Europe

For European clients, the immediate consequence concerns liquidity, not solvency. If the 98% figure is confirmed, the risk of a direct loss of balance is low. On the other hand, platforms are expected to apply additional controls on withdrawals, and addresses associated with the attack to be blocked by other operators. These measures may also slow down legitimate transactions.

For exchanges operating in the European Union, the main lesson concerns internal operational security. A vector based on fake recruitment and internal AI tools shows that the risk lies not only in digital wallets, but also in hiring processes and in employees' privileged access. Supervisory authorities will have an additional argument for demanding stricter internal control standards. The available sources do not, however, document formal reactions from European authorities at this stage.

For individual users, the practical conclusion is that a balance displayed on a platform represents a claim against that operator. Diversifying across platforms, and holding in self-custody the sums that are not actively traded, reduces exposure to incidents of this kind.

Verifiable predictions

Prediction	Horizon	Probability	How it is verified	Verification source
Binance does not apply balance reductions (haircut) to clients	3 months	likely, 65-80%	Absence of any announcement of balance reductions or partial payouts	Binance statements and final report
The final report confirms a recovery of at least 95% of the affected assets	3 months	plausible, 50-65%	Reported recovery percentage is at least 95%	Binance final report; FBI updates
The FBI publishes new addresses or announces seizures linked to the attack	6 months	likely, 60-75%	At least one official announcement of seizure or address listing	FBI and US Department of Justice statements
Additional net withdrawals of over 5% of Binance's assets	1 month	unlikely, 15-30%	Cumulative outflows of over 5% of assets, reported on on-chain data	On-chain analysis reports and financial press coverage

What to watch next

The baseline scenario, of stabilisation without losses for clients, depends primarily on Binance's final report. If it confirms the recovery figure from the preliminary report and explains the difference between funds "covered" and those "recovered", and if withdrawals slow in the following weeks, the scenario is strengthened. Conversely, an announcement of balance reductions, a downward revision of the recovery figures or a new wave of outflows from the platform would weaken it and make the scenarios of stricter regulation or a confidence crisis more plausible. New FBI announcements about addresses or seizures would, in turn, show how much of the stolen funds can still effectively be frozen.

For European users, the immediate stake remains access to their money, not its loss. Even if the baseline scenario is confirmed, withdrawals are expected to be slower and checks more numerous for some time, and any reactions from European authorities could bring stricter rules for exchanges. Until then, the basic caution remains the same: a balance on a platform is a claim against the operator, and spreading funds across several platforms and keeping untraded sums in self-custody limits exposure to incidents of this type.