FBI links $6B Binance hack to North Korea’s TraderTraitor group

South Korea's Financial Services Commission summoned its largest domestic exchanges on Monday to review their defenses, scrutiny an offshore platform like Binance itself escapes. Binance reopened withdrawals in phases rather than all at once, and covered the shortfall through its SAFU fund, a futures insurance fund and treasury reserves rather than passing losses to depositors. Circle's freeze of $1.1 billion in USDC shows stablecoin issuers are now acting as de facto first responders in theft cases.

The FBI's request exposed a structural limit: THORChain's nodes run independently, so no single operator can comply with a law-enforcement order the way a custodial exchange can. That gap is precisely what lets state-sponsored hackers route stolen funds through DeFi rails faster than they can be stopped. It tests whether infrastructure built to resist central control can ever coexist with sanctions enforcement, or whether speed of adoption will keep outrunning the tools meant to contain it.

Binance's self-set Nov. 1 target to fully restore withdrawals, alongside replenishment figures that moved from 95% to 98% in a single day, mark the next checkpoint for its recovery claims. The $2.85 billion already frozen or seized sets a benchmark against the $6.43 billion stolen total. Further recoveries, or continued denial from Pyongyang through Kim Yo Jong, will determine whether the FBI's TraderTraitor attribution ends up treated as settled or as still contested.