FBI names North Korea behind record $6.3B Binance hack

• FBI formally attributes the record $6.3B Binance theft to North Korea's TraderTraitor group, breach on or about October 29
• Binance reopened withdrawals and says it has covered roughly 95% of the stolen funds; Tether and Circle froze about $2.6B
• Spot Bitcoin ETFs kept bleeding ($398M and $643M reported) as BTC failed to reclaim $79,500

Source: U.S. FBI

The FBI just named North Korea behind the record $6.3B Binance hack. Withdrawals reopened, 95% is covered, yet ETF money keeps walking out. So who is really de-risking here?

The FBI has formally named North Korea behind the record $6.3 billion Binance hack. It attributes the theft to the state's TraderTraitor group, with the breach dated on or about October 29. This is the largest crypto exchange hack on record, and the whodunit is now officially closed.

Binance did not wait for that answer to act. It reopened customer withdrawals and says it has covered roughly 95% of the stolen funds.

The cleanup went further. Tether and Circle froze approximately $2.6 billion tied to the hack, locking stolen value in place before it could scatter across chains. On the operational side, the exchange that suffered its worst-ever breach is already running again. So far, so reassuring. The problem is what the capital did while the press releases went out.

Spot Bitcoin ETFs kept bleeding through the fallout, with outflows reported at $398 million and $643 million on separate days. Forced liquidations hit roughly $68 million in Bitcoin and over $40 million in Ethereum. BTC carved a local bottom near $76,326 on October 30, then failed to hold a reclaim of $79,500.

That is the real tension in this story. The attribution answers who, and the recovery answers whether the plumbing held. Neither answers why real money is still net leaving. Operational trust came back quickly; the flows did not follow it.

Attribution lands but liquidity stays tight

Naming the attacker does not refund the liquidity. The FBI attribution settles the investigation, but it does nothing for the money that was frozen, liquidated, or quietly withdrawn from funds in the days around it.

The transmission runs through trust, not headlines. A record theft forced Binance to freeze withdrawals, which briefly questioned the safest assumption in the market: that you can get your coins out. Tether and Circle then froze about $2.6 billion, which reassured victims but reminded everyone that stablecoin value can be switched off by its issuer. That is the uncomfortable macro lesson. Centralised rails recovered fast, yet they recovered by proving how centralised they are.

Reopened withdrawals restore confidence in Binance specifically. They do not restore the risk appetite that forced liquidations and ETF redemptions just removed from the system. Available liquidity is thinner now than before the breach, even with 95% covered.

So the market is pricing two things at once. One is relief that the exchange survived and the attacker is named. The other is a slower, colder realisation that institutional capital used the episode as a reason to reduce exposure rather than add it. When the operational crisis resolves but the capital keeps leaving, the second signal usually matters more than the first.

Frozen funds ripple from BTC to BNB

Bitcoin absorbed the first shock and is still digesting it. Roughly $68 million in BTC longs were liquidated in the fallout, and the market has chopped between that $76,326 bottom and a failed $79,500 reclaim ever since. BTC traded near $77,001, down about 1% on the day.

The tell is not the hack. The tell is that spot Bitcoin ETFs kept redeeming through it, $398 million then $643 million on separate days, while price could not close back above $79,500.

Ethereum took the sympathy hit next. Over $40 million in ETH positions were flushed, a familiar pattern where leverage built on the majors unwinds together once Bitcoin stalls.

Then the move reached the exchange's own token. BNB traded near $696.59, down about 1% on the day and moving in near-lockstep with BTC, up a marginal 0.15% on the hour against Bitcoin's 0.06%. When the majors de-risk, there is rarely a quiet corner for the token most directly tied to the story.

This is the shape of a liquidity squeeze, not a panic crash. Nothing fell off a cliff. Instead, each layer, BTC then ETH then alts like BNB, lost a little depth as frozen funds, liquidations, and steady ETF outflows pulled capital out together. Thin liquidity is why a resolved hack still leaves price unable to push higher.

$79,500 reclaim versus the $76,326 floor

The level to respect is $79,500. BTC has failed to reclaim it since the hack, and that single rejection carries more information than the attribution headline. A clean daily close back above it would argue the fear is finally being bought.

Until then, the burden of proof sits with the bulls.

The second thing to watch is the ETF tape. Outflows of $398 million and $643 million told us real money was reducing, not accumulating. One or two sessions of genuine net inflows would be the first hard evidence that institutions see the resolved hack as a reason to return.

We would treat a reclaim of $79,500 paired with ETF inflows turning positive as the confirmation. Both together, not one alone.

Invalidation is cleaner. If BTC loses the $76,326 bottom from October 30, the shakeout narrative breaks, and the odds shift toward another leg of distribution rather than a base. Watch BNB alongside it; as the token nearest this story, it tends to lead the direction the exchange's own risk is heading.

The honest frame is that no single same-day catalyst is driving this. The attribution is confirmed fact. The read that capital is still de-risking is our interpretation of the flows, and it stays valid only while the ETF outflows and the failed $79,500 reclaim both persist.

Why ETF outflows outweigh the recovery headline

The ParadiseTeam frame here is simple: this hack is a catalyst, not the cause. The turn was already technically due before North Korea was ever named, and the headline merely accelerated a move the structure had set up.

The positioning evidence backs that. A tracked whale closed a Bitcoin long right before the hack on October 28 and has since flipped short. Smart money repositioned ahead of the news, which is usually the whole game.

Retail is doing the opposite. The crowd is reacting to the hack emotionally, trading the fear rather than the levels, while the de-risking that mattered happened quietly days earlier near the $79,000 zone.

On this event's own flow data, that looks closer to continued distribution than to accumulation. The weak-hands-shaking-out story is appealing, but it is not yet confirmed while ETFs keep redeeming and $79,500 keeps rejecting.

So the ParadiseTeam treats $79,500 as former support to reclaim as resistance, not as a floor. A reclaim of that zone and the 0.618 Fibonacci retracement level would open the door back toward the top of the first wave and shift the read. Until then, with BTC near $77,001, our standing stance stays neutral-to-cautious and system-driven: let price prove the reclaim before trusting the relief, because strength into a failed level is exactly where selling tends to wait.

The read behind this: we framed this story through our own market analysis, Binance Hack: Is Bitcoin's Small Drop Bullish?

Related coverage

• Binance hit by record 6 3b hack linked to north korea
• Trump questions north korea blame in binance hack case

For exact entries, targets, and stop losses with full risk management, that is what ParadiseFamilyVIP is for. New to reading these moves? Start with our crypto trading strategies guide.

ParadiseTeam is monitoring the market situation closely, and we are taking these developments into consideration while building our trading tactics inside ParadiseFamilyVIP.