Trump Questions FBI’s Assertion That North Korea Was Behind The $6.3 Billion Binance Heist As Bitcoin Payment Tool BTCPay Server Warns Hot Wallets Are Being Drained
North Korea stands accused of the largest crypto theft in history, billions remain frozen in limbo, and now the tool small businesses rely on to accept bitcoin payments is warning that attackers are actively draining funds from servers right now.
This post may contain links from our sponsors and affiliates, and Flywheel Publishing may receive compensation for actions taken through them.
The FBI said on Saturday, Oct. 31, that the record theft at Binance was linked to “malicious cyber activity” by North Korea’s TraderTraitor group. The FBI says the same group carried out the $1.5 billion Bybit hack in February 2025. That night, reporters at a Halloween party at Mar-a-Lago asked President Trump about the theft. He said: “I’m not concerned. We’re learning about it.” He also said: “We don’t know if it’s North Korea.” According to AP, he added that investigators could still determine that North Korea was responsible.
People with money on an exchange mostly need to know whether they will get it back. A day after the FBI statement, small businesses that accept Bitcoin (CRYPTO:BTC) received their own warning.
How Billions Left Binance in Minutes
Bernard Condon of the Associated Press reported that $6.3 billion in bitcoin and other digital currency was stolen from Binance on Thursday, Oct. 29. AP calls it the biggest crypto heist in history. The firms tracking the theft each have their own estimate. The attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, TRM Labs says. TRM Labs says most of it left in about 20 minutes, starting at 20:05 UTC. Chainalysis said with “a high degree of confidence” that TraderTraitor was behind the $6.4 billion hack.
Binance traced the breach to a DevOps engineer’s compromised laptop. It said it found no evidence that a wallet private key had leaked. Co-CEO Richard Teng said: “To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action.”
What Binance Customers Can Expect
Enough of the same digital currencies that were stolen have been set aside to cover 90% of the missing assets, according to Binance. It has promised to reimburse customers in full. That 90% is money Binance holds in reserve. Customers have not been paid back yet.
An earlier company statement said: “Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe.” Withdrawals resumed on Sunday, Nov. 1, in phases, according to Bloomberg. CNBC reported $3.64 billion in net outflows once withdrawals reopened. Bitcoin is holding near $77,803, down just 0.14% over 24 hours.
Where the Stolen Money Sits Now
TRM Labs says stablecoin issuers and Arbitrum’s Security Council froze about $2.7 billion of the stolen funds. The FBI says the group is converting most of what it took into ether, the native coin of Ethereum (CRYPTO:ETH). The bureau has asked exchanges and analytics firms to block transactions linked to the group’s addresses. TRM Labs says the attacker now holds more than 420,000 ETH and 18,270 BTC. By TRM Labs’ estimate, about $2.4 billion of that is beyond the reach of any issuer.
Ari Redbord, chief policy officer at TRM, expects the money to be laundered through smaller exchanges over a period of months. “It’s bank robbery, in this case, at the speed of the Internet,” he said. He also said: “However, we can also track and trace those funds in real time in order to build investigations, to disrupt and to seize back funds.”
BTCPay Server Merchants Told to Shut Down Now
The second alert is a separate incident. No source has linked it to the Binance theft. BTCPay Server is a free, open-source tool that businesses use to accept bitcoin payments. On Nov. 1, the project told users to switch off their servers: “We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers.” A hot wallet holds the seed phrase needed to send coins on a server connected to the internet.
According to crypto.news, the project’s Nov. 2 post said its investigation had found an attack method aimed at versions 2.4.1 or older. The post also said the project has no credible reports of funds drained on the latest release, 2.4.7. Nicolas Dorier, whom CoinDesk describes as BTCPay’s founder, told CoinDesk that the reported thefts appear to involve versions older than 2.4.2. CoinDesk noted that the original closing call applied to every version.
Dorier said an attacker logged in as an administrator. The team does not yet know how the attacker got that access. All of the version guidance is preliminary.
The project’s advice to merchants:
- Holds servers shut down until the investigation ends.
- Update to the latest release.
- Holds only small balances in hot wallets and move the rest to cold storage, where private keys stay offline.
Open Questions Merchants and Exchange Users Face
BTCPay has not said how much was stolen, how many servers were hit or how many users have reported losses. It has not confirmed how the attack worked. On the Binance side, the next thing to watch is whether the reimbursement covers the full loss or only the 90% Binance has set aside. Freezes have also stopped working on the $2.4 billion the attacker still controls. Recovering that money now depends on blocking the laundering as it happens.
Contact [email protected] for any questions or corrections.
AJ spent 10 years writing about financial markets at The Motley Fool. His coverage centers on technology stocks and the broader macroeconomic trends, from interest rates to geopolitics, that shape where markets are headed next. AJ is drawn to the stories where big-picture economics and individual companies collide.
