Trump Questions FBI Attribution of $6.3 Billion Binance Crypto Theft

President Donald Trump has publicly questioned the Federal Bureau of Investigation’s conclusion that North Korean hackers were responsible for the attack on Binance that resulted in the theft of about $6.3 billion in customer assets, creating a high-level dispute over the attribution of the largest reported crypto-asset theft.

The FBI said on Saturday, Oct. 31, that North Korea was behind the Oct. 29 attack on Binance, the world’s largest cryptocurrency exchange. The value of the stolen assets was equivalent to more than €5.6 billion. Trump, however, said the administration had not reached a definitive conclusion.

“We are looking into it now. We don’t know whether it is connected to North Korea, but if it is, we will discuss the issue with North Korea,” Trump told reporters.

The president made the remarks on Nov. 1 while answering questions from journalists at his Mar-a-Lago estate in Florida. His comments do not establish an alternative explanation for the attack, but they introduce uncertainty at the highest level of the U.S. government over an attribution that the FBI had presented a day earlier.

Attribution dispute complicates the corporate response

For Binance executives and directors, the disagreement matters beyond the immediate investigation. A confirmed link to a state-associated North Korean hacking group would frame the breach as a geopolitical and national-security event, not solely as a failure of corporate cybersecurity. That distinction could influence how the exchange coordinates with law enforcement, monitors transactions and communicates with customers and counterparties.

The FBI attributed the theft to TraderTraitor, a group of North Korean hackers. According to the agency, members of the group typically convert stolen funds into Ethereum, or ETH, before laundering the assets, including through instant cryptocurrency exchange services.

The bureau urged companies involved in crypto-asset transactions to block transfers originating from wallets linked to TraderTraitor. Law enforcement officials published a list of those wallets in the FBI’s press release, placing immediate operational pressure on exchanges and other service providers to screen transactions and prevent the movement of suspected stolen funds.

That request creates a direct compliance issue for the broader industry. Crypto companies must assess whether their transaction-monitoring systems can quickly identify the listed wallets and stop related transfers. They must also consider the risk that stolen assets could be moved through multiple services or converted into other tokens before controls take effect.

Trump’s skepticism does not remove those operational demands. Until investigators provide a different assessment, companies handling digital assets still face the FBI’s call to block the identified transactions. For Binance’s leadership, the central strategic challenge is therefore twofold: restoring customers’ assets while cooperating with an investigation whose geopolitical conclusions have been questioned by the president.

Binance moves to contain customer losses

Binance said on Oct. 31 that it had reimbursed customers for 90% of the funds stolen in the attack. The company said it had fully covered losses involving BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC.

The remaining 10% consists of tokens outside the 10 largest crypto assets, according to the exchange. Binance said those tokens have lower liquidity, meaning that acquiring enough of them to compensate customers in full will require more time.

The reimbursement program is a significant corporate response because it shifts most of the immediate financial burden away from affected users. It also leaves management with the task of completing compensation for less-liquid assets without creating additional market disruption. The company did not provide a timetable in the source material for finishing those repayments.

For the board and senior executives, the speed and completeness of reimbursement are likely to be central to preserving customer confidence after an attack of this scale. The mix of assets involved also highlights the complexity of making clients whole on a platform that supports both highly liquid cryptocurrencies and smaller tokens that may be harder to purchase in volume.

Scale puts governance and resilience under scrutiny

Various estimates indicate that more than 300 million users worldwide are registered on Binance. In 2024, the company said it had more than $160 billion in assets under management. Those figures underscore the systemic importance of the exchange within the digital-asset market and magnify the consequences of any major security incident.

The attack now presents Binance with overlapping strategic priorities: finishing customer reimbursements, strengthening confidence in the platform, tracing the stolen assets and responding to law-enforcement requests. The company must pursue those priorities while U.S. officials publicly differ over whether North Korea was responsible.

The episode also illustrates a broader boardroom risk for crypto businesses. A major breach can rapidly become a matter involving liquidity, compliance, customer retention and international relations at the same time. Decisions about wallet screening, reimbursement and public disclosures therefore carry consequences well beyond a company’s technology operations.

Whether the U.S. government ultimately confirms the FBI’s attribution or adopts a different conclusion, Binance has already committed substantial resources to compensating customers. The remaining test for management is whether it can complete that process for the less-liquid tokens while demonstrating that the platform can respond effectively to a theft affecting billions of dollars in customer assets.