Trump Questions FBI Claim North Korea Stole $6.3 Billion From Binance
The dispute puts Washington’s cyber response in focus as crypto firms face pressure to block wallets linked to the alleged hackers.
President Donald Trump has questioned the FBI’s conclusion that North Korean hackers were behind a cyberattack on Binance, the world’s largest cryptocurrency exchange, and the theft of about $6.3 billion in customer assets.
The president’s comments introduced uncertainty into Washington’s public response to what the FBI described as the largest theft of crypto assets. The disagreement also carries practical implications for American cryptocurrency companies, trading platforms and compliance providers expected to act on federal warnings about wallets allegedly connected to the attackers.
“We are looking into it now. We do not know whether it is connected to North Korea, but if it is, we will discuss this issue with North Korea,” Trump told reporters on Nov. 1 at his Mar-a-Lago estate in Florida.
Trump was responding to an FBI statement issued on Saturday, Oct. 31, attributing the attack on Binance and the loss of roughly $6.3 billion, or more than €5.6 billion, to North Korea. The president did not offer an alternative explanation for the breach, instead emphasizing that the administration was still examining the evidence.
Conflicting signals from Washington
The FBI said North Korean hackers belonging to the TraderTraitor group carried out the Oct. 29 theft. According to the bureau, members of the group typically convert stolen funds into Ethereum, or ETH, before laundering the assets through channels that include instant cryptocurrency exchange services.
The agency urged companies involved in crypto-asset transactions to block transfers originating from wallets associated with TraderTraitor. Law enforcement officials published a list of the relevant wallet addresses in the FBI press release, giving exchanges and other market participants specific identifiers to incorporate into their transaction-monitoring systems.
“We do not know whether it is connected to North Korea, but if it is, we will discuss this issue with North Korea,” Trump said.
For US businesses, the immediate issue is operational rather than diplomatic. Cryptocurrency exchanges, blockchain analytics firms, custodians and payment providers must decide how quickly to implement the FBI’s request while the president publicly declines to endorse the bureau’s attribution. Blocking transactions linked to the listed wallets could help contain the movement of stolen assets, but the conflicting messages may complicate risk assessments and communications with customers.
The episode may also draw attention in Washington to the resilience of crypto infrastructure and the financial capacity of large exchanges to absorb major losses. The size of the reported theft exceeds the annual revenue of many public companies, increasing the likelihood of scrutiny over cybersecurity controls, reserve management and the procedures used to reimburse customers after a platform is compromised.
Binance says customers have received most funds
Binance said on Oct. 31 that it had reimbursed customers for 90% of the assets stolen during the recent attack. The company said it had fully covered losses involving BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC.
The remaining 10% consists of tokens outside the 10 largest assets identified by the platform. Binance said those tokens have lower liquidity, meaning that purchasing enough of them to complete customer compensation will require more time. The distinction matters for businesses assessing counterparty exposure because reimbursement speed depends not only on the dollar value of a loss but also on the depth of trading markets for individual assets.
Binance’s ability to replace most of the stolen assets quickly may limit the immediate customer impact, but the outstanding balance remains significant given the overall scale of the attack. The company did not provide a new timetable in the source account for completing reimbursement of the less-liquid tokens.
Estimates place Binance’s global registered user base at more than 300 million. In 2024, the company reported that it had more than $160 billion in assets under management. Those figures underscore the exchange’s importance to global crypto markets and the potential for disruptions on its platform to affect liquidity, pricing and confidence well beyond its own customers.
Business consequences beyond Binance
American firms that touch digital-asset transactions now face heightened pressure to screen activity connected to the wallet addresses published by the FBI. The warning is particularly relevant to exchanges and instant-swap services, which the bureau identified as part of the laundering pattern generally used by TraderTraitor.
The attribution dispute could also influence the administration’s next steps. A confirmed connection to North Korea would turn the case from a corporate cybersecurity incident into a matter involving US foreign policy and national security. Trump said the United States would discuss the issue with North Korea if that connection is established, but he gave no details about the possible format or timing of such talks.
Until the administration resolves its position, companies must navigate two messages from Washington: a detailed law-enforcement attribution and blocking request from the FBI, and a public statement from the president that the North Korean link remains unconfirmed. The bottom-line concern for US businesses is whether existing controls can identify the listed wallets, stop prohibited or high-risk transfers and manage customer losses if stolen funds move through American platforms.
