Two questions were left hanging after US$6.3 billion walked out of Binance in roughly twenty minutes. Who did it, and how did they gain enough control over Binance's signing systems to move billions across eleven blockchains. The original account named ten. Elliptic's later accounting added an eleventh, the NEAR blockchain. On October 31, one of those questions was answered.
The FBI has now formally attributed the Binance theft to North Korea. In its alert, the Bureau identifies the activity as TraderTraitor. CrowdStrike tracks the same North Korean operation as PRESSURE CHOLLIMA and lists TraderTraitor, Jade Sleet, Slow Pisces, and UNC4899 among the names used by other researchers. The original investigation, North Korea Drained Binance of US$6.3 Billion in a Mere Twenty Minutes, reached the same attribution through the tradecraft surrounding the operation before any government had publicly named the actor. The FBI has now put federal attribution behind it. The who is no longer the mystery. The how still remains undetermined.
The federal attribution leaves the original piece's central question untouched. The FBI maps the money and names the adversary. It does not explain how PRESSURE CHOLLIMA reached Binance's wallets. The group's known tradecraft includes social engineering, fake employment approaches, fraudulent companies, and carefully constructed access operations, but the Bureau connects none of those techniques to this intrusion. Binance has still not published a root cause. How PRESSURE CHOLLIMA obtained enough operational authority to make legitimate signing infrastructure move billions across chain after chain remains unanswered.
The FBI does tell us what happened next. Investigators observed PRESSURE CHOLLIMA converting the stolen assets primarily into Ethereum and expect further laundering through decentralized finance platforms and instant swap services. The Bureau published Ethereum addresses connected to the stolen funds and asked THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics companies, and other virtual asset providers to block transactions involving them or assets derived from them.
Elliptic puts the scale of this attack into perspective. This single operation almost doubles the total cryptocurrency it estimates North Korean actors had stolen before Binance. Its previous estimate exceeded US$6.5 billion.
That turns attribution into something more useful than a name on a government document. The intrusion happened inside Binance, but containment now reaches across an ecosystem of exchanges, node operators, DeFi protocols, analytics companies, stablecoin issuers, bridges, and other services. One institution lost the money. An entire industry is being asked to make it harder for PRESSURE CHOLLIMA to spend.
Attribution here has crossed from explanation into disruption. A blockchain can make stolen cryptocurrency extraordinarily visible without possessing any native mechanism for deciding whether the person moving it should be allowed to do so. Every exchange rejecting an address, every service closing a laundering route, and every provider refusing contaminated funds adds friction the underlying ledger cannot provide. Elliptic has taken the same approach independently, publishing a blocklist of addresses attributed to the Binance theft so companies can screen against them while the funds continue moving. The offensive operation ended when the wallets emptied. The contest over whether North Korea can convert what it stole into usable money remains underway.
The financial question hanging over the original piece is also beginning to resolve. Binance resumed withdrawals in phases on November 1 and says approximately ninety-five percent of the affected assets have now been replenished using company resources. BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed, while the remaining roughly five percent consists of less liquid tokens Binance says require more time to acquire at scale. Deposits remained open throughout the recovery, and Binance continues to insist the financial loss will fall on the company rather than its users.
So far, the evidence supports Binance's claim it can absorb the financial damage. The more consequential security question remains open. The FBI can name PRESSURE CHOLLIMA. Blockchain investigators can follow the money. Binance can replace the assets. None of this explains what failed inside Binance to turn its own signing systems against itself, allowing all that money to so easily walk right out the door.
Binance says a post-incident report will follow when its investigation is complete. That report matters far beyond Binance. US$6.3 billion can be replaced by a sufficiently large balance sheet. A signing architecture capable of mistaking hostile intent for legitimate authority is a different kind of liability.
Until Binance explains what PRESSURE CHOLLIMA reached, how it reached it, and why the blast radius crossed so many chains, the largest cryptocurrency theft in history only has attribution for now.