President Trump told reporters on Friday, October 30 that the United States is investigating whether North Korea was behind the record $6.3 billion Binance hack, stressing that no conclusion has been reached: 'We don't know. We're looking at that.'

He added that Binance had told him the situation was largely under control and that the company claims it will get the stolen assets back.

Blockchain intelligence firm TRM Labs has attributed the attack with high confidence to TraderTraitor, a hacking group linked to North Korea, and other reports have pointed to the Lazarus Group, both long associated with major cryptocurrency thefts.

Binance has not officially attributed the breach to North Korea, and officials have not published findings, so North Korean responsibility remains a working hypothesis rather than a confirmed fact.

That distinction matters: an expert attribution is not the same as an investigative conclusion, and the probe Trump described is still open.

Binance initially reported that the attack began with a compromised laptop belonging to a DevOps engineer, which let attackers access a service container and execute unauthorized withdrawals.

The company later said investigators identified multiple points of breach and that malicious software may have been designed to erase evidence, according to co-CEO Richard Teng.

Seventeen hot wallets across Ethereum, Bitcoin, Tron, Solana, XRP Ledger, Arbitrum, Avalanche, Optimism, Base and Polygon were affected, with the transactions accepted because they carried valid digital signatures.

Attackers allegedly exploited Ethereum's EIP-7702 mechanism through pre-signed authorization transactions, and preparatory transactions suggest a carefully planned operation. Binance says there is no evidence private wallet keys were leaked.

Binance has set aside roughly $6.34 billion to cover affected assets, with about $5 billion already held in the same assets involved — around 80% of the estimated impact — and froze approximately $3 billion through cooperation with blockchain networks, stablecoin issuers and other industry participants.

EntARABI reports Tether froze about $1.567 billion in USDT, Circle froze around $800 million, and World Liberty Financial froze roughly $27 million in USD1.

Withdrawals were temporarily suspended, with a phased resumption targeted within about 34 hours of Binance's update, and an updated Proof of Reserves snapshot is expected by Monday, November 2.

The response also touched DeFi: Aave restricted new supply and borrowing across hundreds of markets after a wallet tied to its ecosystem was used to deposit $60 million in USDT and borrow about 19,762 WETH.

The breach has reignited the custody debate.

University of Tulsa cybersecurity professor Tyler Moore told CNBC it is 'extremely dangerous' to leave significant funds on an exchange, noting there is no FDIC-style insurance for crypto, while Blockaid CEO Ido Ben-Natan argued users will not lose money because Binance is covering losses.

CFTC Chairman Michael Selig told CNBC the offshore nature of the incident was critical, saying offshore platforms lack US safeguards and proposing a federal registration option, though University of Pennsylvania professor Brett Falk said US rules likely would not have stopped a compromise that began on an engineer's laptop.

The Digital Chamber has called on Congress to advance legislation strengthening the CFTC's oversight role and the separation of customer funds.