Binance Recovers 98% of $6.3 Billion Stolen in Record Crypto Hack as FBI Blames North Korea

Binance, the world’s biggest cryptocurrency exchange, says it has now replaced 98% of the $6.3 billion stolen from it in the largest crypto theft ever recorded. The Binance hack, carried out on 29 October 2026, froze withdrawals for millions of users, and the US Federal Bureau of Investigation (FBI) has blamed a hacking unit linked to North Korea.

Withdrawals reopened in stages from 1 November. Customers pulled billions out in the first hours, but the exchange says the rush has calmed, customers will not lose money, and it has set aside enough of its own funds to cover the loss.

This is what happened, who the FBI says did it, how Binance is paying for it, and what it means for anyone who holds crypto.

At a glance

• What happened: Hackers stole about $6.3 billion in cryptocurrency from Binance’s hot wallets on 29 October 2026, most of it in around 20 minutes. It is the largest cryptocurrency theft on record.
• Who is blamed: The FBI said on 31 October that North Korea’s state-backed hacking unit, TraderTraitor, was responsible. North Korea denied the accusation on 3 November.
• What Binance has done: The exchange says it has replenished about 98% of the stolen assets using its own money, and it has set aside around $6.34 billion of company funds to cover the loss. Customers will not bear the cost, it says.
• Withdrawals: They reopened in phases from Sunday 1 November, starting with 15 networks including bitcoin and ether. More networks were added from 3 November.
• Money frozen: About $3 billion of the stolen assets has been located and frozen with the help of industry partners.
• Customer reaction: Customers withdrew a net $3.64 billion, about 2.1% of the exchange’s assets, in the first nine and a half hours after withdrawals reopened. Binance says the flow has since returned to normal.

What happened on 29 October

The attack began late on Thursday 29 October. Hackers drained Binance’s hot wallets — the online wallets an exchange uses for day-to-day transactions — across 10 blockchain networks. According to blockchain analysis firm TRM Labs, about $6.36 billion left Binance wallets, with most of the transfers happening in roughly 20 minutes from 20:05 UTC.

Binance described the total as approximately $6.3 billion. Either way, it is the biggest cryptocurrency theft ever recorded, dwarfing the previous record: the $1.5 billion stolen from the Bybit exchange in February 2025, which was also blamed on North Korean hackers.

The exchange suspended withdrawals while it investigated what had happened. Trading and deposits stayed open, but customers could not take their crypto out. For an exchange with 335 million registered users and about $162.8 billion in assets under custody, according to its 2025 annual report, that was a serious shutdown.

Crypto prices fell on Friday as the news spread, while Binance worked to reassure customers that their funds were safe.

How the hackers got in

At first, Binance co-CEO Richard Teng described the breach as a “complex attack” involving a compromised laptop and malicious software designed to delete evidence of its activity. A fuller picture has since emerged, and it shows the attackers spent months preparing.

In June 2026, the attackers set up a fake version of a developer tool and lured an engineer into installing it. A Binance security report published on Tuesday 3 November says a DevOps engineer on the exchange’s wallet infrastructure team downloaded a tampered Homebrew installation while searching for a popular AI coding tool.

In September, the attackers posed as recruiters and put another engineer through a series of job interviews that ended in a coding exercise carrying hidden malware built to evade security tools. From there, Teng said, they moved through Binance’s internal AI tools and reached the system that authorises wallet transactions.

Teng has rejected the idea that a single compromised laptop was to blame. Binance says it detected the June activity, replaced the device and rotated credentials, yet the engineer’s role and colleagues on the wallet team remained exposed. The exchange says it has since rebuilt its wallet system and its internal AI tool, decommissioned credentials and tokens for affected engineers, and widened its device scans.

The pattern matches earlier North Korea-linked thefts, according to TRM Labs, including the Bybit hack and the KelpDAO hack in April 2026.

The FBI points to North Korea — and Pyongyang denies it

On Saturday 31 October, the FBI published a cyber alert titled “North Korea Responsible for $6 Billion+ Binance Attack”. It said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about 29 October, naming the activity “TraderTraitor”.

The FBI said law enforcement had observed members of the unit converting the stolen assets into ether, the cryptocurrency of the Ethereum network, and that it expected “further laundering” of the assets. TRM Labs and Chainalysis, two blockchain analysis firms, had already tied the attack to TraderTraitor before the FBI’s announcement.

Not everyone in Washington agreed at once. US President Donald Trump said on Saturday that the United States was still not certain if North Korea was involved. “We don’t know if it’s North Korea — but if it is, we’ll talk to North Korea about it,” he told reporters, in comments posted by a White House account on X.

North Korea itself denied the accusation on Tuesday 3 November. Kim Yo Jong, the sister of leader Kim Jong Un, rejected the FBI’s claim in a statement carried by North Korean state media, calling it “absurd rhetoric” and a political provocation. Pyongyang has for years denied using state-linked cyber units for espionage, financial theft and revenue.

The disagreement matters because an FBI attribution is a law-enforcement assessment, not a finding tested in court, and the tracing and freezing work is still under way. But the weight of the evidence — the FBI, TRM Labs and Chainalysis all pointing the same way — has made TraderTraitor the central suspect.

How Binance is covering the $6.3 billion

Binance’s answer to the theft has been simple: it will pay for it itself. The exchange has repeatedly said it will bear the financial impact of the hack, not its users, and it has set aside around $6.34 billion of company funds internally to cover the losses.

The money came from three places: the exchange’s $1 billion Secure Asset Fund for Users (SAFU), a bitcoin reserve it holds to protect customers in the event of security breaches; part of its Futures Insurance Fund; and its corporate treasury. Co-CEO Yi He said on Saturday that 50% of SAFU funds would be used, while the company committed to replenishing the fund to about $1 billion.

The recovery has moved fast. Binance said on Saturday 31 October that it had covered up to 90% of the affected assets. By Sunday 1 November, when withdrawals began to reopen, that figure had risen to about 95% — roughly $6 billion of the stolen tokens replaced with company money. In its seventh recovery update, published on 4 November, Binance said about 98% of the affected assets had now been replenished, with the remaining 2% in less-liquid tokens still being bought through market and over-the-counter channels.

It is important to understand what that 98% figure means. It measures what Binance has restored to customers using its own funds, not what it has recovered from the attackers. The stolen crypto itself is mostly gone. About $3 billion of it has been located and frozen, Binance and industry partners including Tether, Circle and Ripple have reported, while some of the remainder continues to move through laundering channels.

Binance has also said it has commissioned an independent expert to review its response, and it plans to publish a post-incident report once its investigation concludes.

Withdrawals reopen — and customers pull out billions

Withdrawals returned in phases from Sunday 1 November. The first window opened at 06:00 GMT, and the first phase covered 15 networks: Bitcoin, Ethereum, BNB Smart Chain, Tron, Solana, the XRP Ledger, Zcash, Dogecoin, TON, Polygon, Avalanche C-Chain, Arbitrum, Base, Optimism and Sui. Bitcoin, ether, XRP and dogecoin were among the first tokens available, along with selected USDT and USDC stablecoins.

Ten assets — bitcoin, ether, tether, BNB, Solana, USDC, XRP, USD1, RLUSD and zcash — were fully backed and available first. Withdrawals entered a second phase on 3 November, reopening additional assets across nine networks.

The reopening triggered an immediate rush. Between 06:00 and 15:30 UTC on Sunday 1 November, customers withdrew $4.649 billion and deposited $1.01 billion, producing a net outflow of approximately $3.64 billion — about 2.1% of the exchange’s assets. By Monday 2 November, Reuters reported net client withdrawals of $4.72 billion.

By Tuesday, the picture had steadied. Speaking at an event in Hong Kong, co-CEO Richard Teng said the flow of withdrawals had practically returned to normal and that the company remained in solid financial condition.

For context, the outflow was large in dollars but small in proportion: just over 2% of the exchange’s assets left in the first day. That is the number Binance points to when it says confidence held. Critics point to the same number and say $3.64 billion leaving in nine hours is still a warning sign.

Why this hack is different

Crypto thefts are not new. Last year, attackers stole $2.9 billion worth of cryptocurrency across nearly 150 attacks, according to TRM Labs. What makes the Binance hack different is its size, its target, and its method.

First, the size. At $6.3 billion, it is more than four times the Bybit theft that held the record until now.

Second, the target. Binance is the world’s largest crypto exchange. An attack on a small platform is a crime story; an attack on Binance is a test of the whole crypto industry’s security. If the biggest exchange, with the biggest security budget, can lose $6.3 billion in 20 minutes, smaller platforms are asking hard questions about their own defences.

Third, the method. This was not a smash-and-grab. The attackers spent at least four months inside Binance’s orbit: a fake developer tool in June, a fake recruitment process in September, movement through internal AI tools, and signatures collected in advance so the theft could be executed in a single burst. It was, in effect, a long con that ended in a 20-minute robbery.

Fourth, the response. Binance covered the loss from its own balance sheet within days, something few exchanges could do. That is why withdrawals could reopen in three days and why the wider crypto market stayed relatively calm. But it also raises a question: what happens if the next victim cannot afford to pay?

What it means for users in Pakistan

Binance is one of the most widely used crypto platforms in Pakistan, where many people trade through its peer-to-peer marketplace. Cryptocurrency trading has no formal regulatory framework in Pakistan, which means users have little official protection if an exchange fails or is hacked.

For Pakistani users, the Binance hack carries three lessons. The first is that even the biggest exchange can be breached, and that “too big to fail” is not a security guarantee. The second is that Binance’s ability to cover the loss came from its own reserves — a safety net that exists because the company chose to build it, not because any regulator required it. The third is practical: crypto kept on an exchange is crypto you do not fully control. Moving larger holdings to a personal wallet is the oldest advice in crypto, and this hack is the latest reason for it.

How to protect your crypto

No system is completely safe, but a few habits reduce the risk sharply:

• Do not keep large amounts on an exchange. Use exchanges to buy and sell, then move long-term holdings to a personal wallet where you control the private keys.
• Turn on two-factor authentication. Use an authenticator app rather than SMS where possible, and never share verification codes with anyone.
• Beware of fake job offers and coding tests. The Binance attackers used fake recruitment to plant malware, so treat unexpected interview tasks and software downloads with suspicion.
• Check before you download. The June stage of this attack began with a tampered copy of a popular developer tool. Download software only from official sources.
• Keep records. If you trade crypto, keep your own records of deposits, withdrawals and transactions, so you are not relying on an exchange’s systems alone.

Frequently asked questions

Has Binance resumed withdrawals?

Yes. Withdrawals resumed in phases from Sunday 1 November, starting with 15 networks including bitcoin and ether. A second phase began on 3 November, adding more networks and assets. Some withdrawals were temporarily restricted on Tuesday 3 November, and availability still depends on the asset and network.

Will Binance customers lose money?

Binance says no. It has set aside around $6.34 billion of company funds to cover the losses and says it has replenished about 98% of the affected assets.

Who stole the $6.3 billion?

The FBI says North Korea’s state-backed hacking unit, TraderTraitor, was responsible. TRM Labs and Chainalysis reached the same conclusion. North Korea denied the accusation on 3 November, and President Donald Trump said the US was not yet certain.

Is the stolen crypto being recovered?

About $3 billion of the stolen assets has been located and frozen with the help of industry partners including Tether, Circle and Ripple. The rest is still being traced, and the FBI says the attackers are converting the funds into ether and laundering them further.

Was this the biggest crypto theft ever?

Yes. At about $6.3 billion, it is the largest cryptocurrency theft on record, more than four times the $1.5 billion Bybit hack of February 2025.

What is TraderTraitor?

TraderTraitor is the name US authorities give to a North Korean state-sponsored hacking operation, blamed for a string of large crypto thefts including the Bybit hack.

Conclusion

The Binance hack is a story of two halves. The first half is alarming: the world’s biggest crypto exchange lost $6.3 billion in 20 minutes to attackers who had spent months working their way in through fake software and fake job interviews, and the FBI says a North Korean hacking unit did it.

The second half is reassuring, at least so far. Binance paid for the loss itself, restored 98% of the affected assets within a week, and reopened withdrawals in three days. About $3 billion of the stolen funds has been frozen.

Whether that is enough depends on what happens next. The remaining 2% of assets still needs to be sourced, the stolen funds are still being laundered, and the full technical report has not yet been published. The deeper question is whether an attack this sophisticated can be stopped at all — or whether the next target will be an exchange that cannot afford to pay.

Sources

• https://www.reuters.com/legal/government/binance-resumes-bitcoin-withdrawals-after-covering-bulk-stolen-63-billion-2026-11-01/
• https://leprivatebanker.com/2026/11/05/binance-says-it-has-replenished-98-of-6-34-billion-stolen-in-record-hack-as-fbi-points-to-north-korea/
• https://www.tekedia.com/binance-resumes-crypto-withdrawals-after-covering-95-of-6-3-billion-hack-losses/
• https://coinmarketcap.com/academy/article/binance-recovery-update-4-withdrawals-resume-95-percent-covered
• https://cryptocompass.com/articles/binance-resumes-withdrawals-across-15-networks-after-6-3-billion-hack-reports-3-64-billion-net-outflow
• https://www.radardigital.ai/en/articles/binance-hack-95-percent-north-korea/
• https://mlq.ai/news/north-korea-denies-fbi-accusation-over-63-billion-binance-hack-as-withdrawals-resume/

This article is for general information and education only. It is not legal or financial advice.