FBI Ties $6.3B Binance Hack to North Korea, About $3B Frozen
The FBI pinned the $6.3B Binance hack on North Korea's TraderTraitor group, and the Secret Service says partners froze a large share. Stablecoins got frozen; Bitcoin can't be. Here's why ETF custody concentration is now the variable to watch.
North Korea's TraderTraitor group pulled off the roughly $6.3 billion Binance attack, the FBI said on Oct. 31. A big chunk of the loot is already stuck: the US Secret Service said on Nov. 1 that it worked with industry partners to freeze a large share of the stolen assets, and Binance estimates those partners have frozen about $3 billion.
Since our earlier coverage of the Oct. 29 breach, the story has moved from "what happened" to "who did it and what can be clawed back." The FBI published its attribution in an alert on fbi.gov. TRM Labs put the total at $6.36 billion across 10 blockchains and said the attack likely involved compromised hot-wallet signing systems.
The Secret Service said on X that it continues investigating and froze a significant portion of funds with industry partners.
Stablecoin issuers account for roughly $2.3 billion to $3 billion of the frozen funds. That matters: a stablecoin has an issuer who can freeze tokens on-chain. CZ thanked the agencies in a Nov. 2 X post:
"Your speed, expertise, and dedication helped contain the damage and reduce the risk of potential ripple effects across crypto and, may I say, even the broader financial markets,"
Changpeng Zhao
The market bill
Sentiment took the hit first. The Crypto Fear & Greed Index dropped to 30 on Oct. 30 from 51 before the breach. Bitcoin slid to six-week lows near $76,400 and BNB fell 6% to 8%. Futures liquidation estimates run from above $1.5 billion on Oct. 30 to more than $1.6 billion within 24 hours.
Bitcoin has since traded near $77,874, down 0.22% on the day and 7.92% over 30 days.
Why custody is now the question
The attribution feeds a worry about where the next attempt lands. OneKey founder Yishi Wang pointed at BlackRock's iShares Bitcoin Trust (IBIT), which held about $62 billion in net assets as of Oct. 30 and roughly 815,000 BTC as of Oct. 29, about 3.9% of maximum supply.
"I suspect [the fund] is already on North Korea's shortlist"
Yishi Wang, founder of OneKey
Wang posted the warning on X.
His reasoning rests on the February 2025 Bybit hack (about $1.5 billion), where attackers compromised a Safe{Wallet} developer's computer and altered the signers' approval screen, per a Sygnia forensic investigation. Chainalysis linked North Korean hackers to about 89% of crypto theft losses in 2026.
Be clear on what this is not. There is no evidence that IBIT or Coinbase's custody systems have been compromised, and Wang's post does not show hackers are targeting the fund. Coinbase CSO Jeff Lunglhofer said on Oct. 29 that the exchange was blocking transfers to compromised Binance wallets and had adjusted its cold storage systems out of an abundance of caution. The company said its infrastructure remained secure.
The loss-absorption gap
Coinbase is IBIT's main Bitcoin custodian. BlackRock added Anchorage Digital, but its June 30 quarterly filing said it has no current plans to move Bitcoin away from Coinbase. Its annual filing shows Coinbase holds commercial crime insurance shared among all its customers, and the custody agreement generally caps Coinbase's liability at $100 million per cold storage address, with some exceptions.
That is the trader's takeaway. Stablecoins can be frozen, as this week showed. Bitcoin has no central freeze switch, so shareholders in a hypothetical custody breach could face losses that tracing, insurance or custodian payments may not fully cover.
An April 8 snapshot found funds naming Coinbase in a custody role held more than 80% of US Bitcoin ETF assets. Concentration is the real variable to watch, not any confirmed weakness.
