Trump Questions FBI Link Between North Korea and $6.3bn Binance Hack

US President Donald Trump has questioned the Federal Bureau of Investigation’s assessment that North Korean hackers were responsible for an attack on Binance, the world’s largest cryptocurrency exchange, and the theft of about $6.3 billion in customer assets.

The disagreement places the attribution of the largest reported cryptoasset theft at the center of a broader debate over cybersecurity, sanctions enforcement and financial stability in the digital economy. It also raises immediate operational questions for exchanges, instant-swap services and other companies that may encounter funds linked to the attack.

Speaking to reporters at his Mar-a-Lago estate in Florida on November 1, Trump said the US government was still examining the incident and had not established to his satisfaction that North Korea was involved.

“We are looking into it now. We don’t know whether it is connected to North Korea, but if it is, we will discuss this issue with North Korea,” Trump said.

His comments came after the FBI said on Saturday, October 31, that North Korea was behind the cyberattack on Binance and the theft of approximately $6.3 billion, equivalent to more than €5.6 billion, from the exchange’s customers.

FBI urges crypto companies to block linked wallets

The FBI attributed the October 29 theft to North Korean hackers associated with the TraderTraitor group. According to the agency, members of the group typically convert stolen funds into Ethereum, or ETH, before laundering the assets through several channels, including instant cryptocurrency exchange services.

The agency urged companies handling cryptoasset transactions to block transfers involving wallets associated with TraderTraitor. Law enforcement officials published a list of the relevant wallet addresses in their press release, giving exchanges and compliance teams specific identifiers to incorporate into transaction-monitoring systems.

For the crypto industry, the request highlights the growing role of blockchain analytics, automated sanctions screening and wallet-level risk controls. Although public blockchains can allow investigators to trace movements of digital assets, attackers may attempt to obscure those movements by converting tokens, splitting transactions among multiple addresses or using services designed to exchange assets rapidly.

The difference between the FBI’s conclusion and Trump’s more cautious public position could complicate the political response without changing the immediate compliance burden for financial technology companies. Crypto exchanges, custodians and payment providers must assess whether transactions touch wallets identified by law enforcement while also managing liquidity, customer withdrawals and exposure to assets affected by the breach.

Binance says 90% of stolen funds have been reimbursed

Binance said on October 31 that it had reimbursed customers for 90% of the funds stolen in the recent attack on its platform. The company said it had fully covered losses involving BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC.

The remaining 10% consists of tokens outside the ten largest assets involved, according to the exchange. Binance said those tokens have lower liquidity, meaning that acquiring enough of them to complete customer compensation will take more time.

That distinction is important for digital-asset markets because reimbursement capacity depends not only on the dollar value of losses but also on the depth of trading in each token. Large purchases of less-liquid assets can be harder to execute quickly and may affect market prices, forcing an exchange to balance the speed of compensation against orderly trading.

The scale of the reported theft also puts renewed focus on the reserves and risk-management systems of major crypto platforms. Various estimates place Binance’s registered user base at more than 300 million worldwide. In 2024, the company said it had more than $160 billion in assets under management.

A loss of $6.3 billion would therefore represent a major cybersecurity and customer-protection event even for a platform of Binance’s size. Its decision to reimburse most affected holdings may limit the immediate impact on individual users, but the incident could intensify scrutiny of exchange security, custody arrangements and the financial resources available to absorb large operational losses.

Digital finance faces another test of trust

The attack underscores how cybersecurity has become inseparable from payments and digital banking. Stablecoins such as USDT and USDC are widely used to move value within crypto markets, while assets including BTC and ETH increasingly interact with institutional trading, custody and fintech infrastructure. A breach affecting multiple major tokens can therefore create risks beyond a single exchange.

Publicly traded companies with exposure to crypto trading, custody, blockchain analytics or cybersecurity may also face closer investor attention as markets assess the potential for higher compliance and security spending. The incident does not establish a direct financial impact on any particular technology stock, but it reinforces the importance of cyber resilience across the digital-asset ecosystem.

For now, the central uncertainty is attribution. The FBI has publicly identified TraderTraitor and North Korea, while Trump has said the connection remains under review. Crypto companies, however, must respond to the traceable financial consequences immediately by screening the listed wallets, monitoring the movement of ETH and other assets, and managing customer claims arising from the attack.