Binance covered 90% of losses. Coverage barely covered that.
The FBI's attribution of the $6.43 billion Binance theft to North Korea's TraderTraitor group is the news peg every outlet used. The more consequential detail — that Binance has already replaced 90% of stolen funds and resumed bitcoin and ether withdrawals — got buried below the fold in most coverage or omitted entirely. The Guardian is the only outlet that put both facts in its headline. The story most readers got was a nation-state whodunit. The story that actually affects Binance's 230 million users is whether their money came back.
FBI links North Korea's TraderTraitor group to $6.3–6.4 billion Binance crypto heist
6 sources · hover a dot to see coverage
What happened
On November 1, 2026, the FBI publicly attributed the theft of more than $6.43 billion in cryptocurrency from Binance to TraderTraitor, a North Korea-aligned hacking group the bureau has previously linked to a $1.5 billion hack of exchange Bybit. The Binance theft is the largest crypto heist on record. The FBI said the operation involved "malicious cyber activity" executed within minutes. Separately, Binance announced it had covered approximately 90% of the stolen funds and resumed withdrawals of bitcoin and ether as of Sunday. The two developments — criminal attribution and operational recovery — arrived simultaneously but were treated as separate stories by most outlets. Six outlets covered some version of this; what they chose to lead with split cleanly along a single editorial choice.
The Guardian put the recovery news in the headline. Nobody else did.
The Guardian's headline reads: "Binance says 90% of losses from $6.3bn hack covered as FBI says North Korea behind attack." That is the only headline in this set that gives equal billing to the recovery. Every other outlet led with the FBI attribution and either buried the withdrawal resumption in the body or skipped it. For the 230 million people who use Binance, the 90% recovery figure is the operative fact. The Guardian treated it that way.
Reuters ran two near-identical headlines and still missed the attribution
Reuters filed two versions of the same story within hours of each other. The first: "Binance to resume withdrawals after recovering bulk of $6 billion in stolen funds." The second: "Binance resumes bitcoin, ether withdrawals after covering bulk of stolen $6.3 billion." Neither headline names North Korea or TraderTraitor. Both treat this as a financial operations story, not a national security one. That is a defensible editorial call — Reuters covers markets — but readers who saw only the Reuters wire got no indication that the FBI had just publicly named a state actor.
The Hacker News had the most precise number. Everyone else rounded.
The Hacker News reported "$6.43 billion" while DW used "$6 billion," Reuters used "$6.3 billion," the NY Post used "$6.3B," and the Guardian used "$6.3bn." The FBI's figure, per The Hacker News, is $6.43 billion. The difference is $130 million. In a story about the largest crypto theft in history, the rounding choices are not trivial — and The Hacker News, a specialist outlet, was the only one that didn't round.
What one side told you that the other didn't
Binance's recovery is the user story. Most outlets skipped it.
Five of six outlets led with the FBI attribution. Only the Guardian put the 90% fund recovery in its headline. Reuters, to its credit, led with the recovery but dropped the attribution entirely. No outlet gave both facts equal weight in a single headline except the Guardian. For anyone with assets on Binance, the recovery percentage is more immediately consequential than the geopolitical attribution. The coverage gave readers the spy story and left the financial story on the cutting room floor.
Fox Business is in the source list. Its coverage isn't here.
Fox Business was identified as a source in this set but contributed no excerpted coverage. A $6.43 billion theft attributed to North Korea — a story with national security implications and direct market consequences — is exactly the kind of story a financial news outlet staffs. Its absence from the substantive coverage is the gap, not a framing choice. Readers who rely on Fox Business for crypto or markets coverage got nothing from the outlet that is supposed to own that beat.
TraderTraitor's Bybit connection appeared in one outlet.
DW is the only outlet that named TraderTraitor's prior $1.5 billion Bybit hack in its excerpt, contextualizing this as part of a pattern rather than a single event. The Hacker News covered TraderTraitor extensively by name but its excerpt does not surface the Bybit precedent. The NY Post and Reuters make no mention of it. That prior hack matters: it establishes TraderTraitor as a serial actor, not a one-time threat, and it changes the risk calculus for every major exchange. One outlet said so.
What to watch
Binance says 90% of stolen funds are covered. The remaining 10% — roughly $640 million at the $6.43 billion figure — has no public recovery timeline. If Binance announces a path to covering the remainder before the end of November, watch whether outlets that led with the FBI attribution pivot to the financial recovery story, or whether the national security frame stays dominant and the user-facing news gets buried again.
See how outlets across the political spectrum framed this differently — and what each side left out.