Binance Replaces 90% of $6.3B Hack; FBI Blames North Korea

Binance has replaced 90% of the assets stolen in the record $6.3 billion hack that hit the exchange on 29 October 2026, while the FBI publicly attributed the attack to TraderTraitor, a North Korean state-sponsored cyber unit. Co-CEO Richard Teng said the remaining 10% of less liquid tokens would also be covered, ensuring users bear no financial impact, as phased withdrawals resumed on Sunday 1 November.

What happened in the record Binance hack?

The theft, described by Elliptic's chief scientist as "almost certainly the single largest-known theft of any kind", unfolded over roughly 20 minutes between 20:05 and 20:20 UTC across ten blockchains. Hackers drained approximately $6.36 billion, including $3.8 billion in Ether, 18,270 Bitcoin worth about $1.5 billion, and hundreds of millions of dollars in TRON, XRP and Solana. The attack surpassed the previous record, the Bybit hack of 2025, by more than four times. According to TRM Labs, the heist involved a compromised DevOps engineer's laptop and abuse of an EIP-7702 delegation on Ethereum's hot wallet. Roughly $3 billion in stablecoins was frozen within hours by Tether and Circle, according to Wikipedia's account of the incident.

FBI blames North Korea's TraderTraitor group

In an alert dated 31 October, the FBI, working with the U.S. Secret Service and IRS-Criminal Investigation, said North Korea was responsible and designated the malicious cyber activity as TraderTraitor. The group, also tracked as Jade Sleet, Slow Pisces and UNC4899, is part of the Lazarus Group. The FBI observed the actors converting stolen assets primarily into Ether and warned of further laundering through DeFi and instant-swap services. It urged THORNode, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms to block transactions involving the listed addresses, as detailed in the FBI's official alert. North Korea denied involvement, with Kim Yo Jong dismissing the finding as "absurd rhetoric."

How Binance is making users whole

Binance set aside more than $6.34 billion in company funds, drawing on its Binance Secure Asset Fund, part of its futures insurance fund and corporate treasury, to buy back stolen assets. It said user holdings in BTC, ETH, USDT, BNB, SOL, USDC, XRP and other tokens are now fully backed. Teng said: "We are committed to covering the remaining gap so users bear no financial impact." The remaining 10% consists of less liquid, non-top-ten tokens that may take longer to acquire, according to Daily Hodl. Withdrawals resumed Sunday in phases, with Ethereum-based tokens and BNB Smart Chain assets released first, followed by Dogecoin and Avalanche, as reported by The Guardian.

Market impact and regulatory scrutiny

Bitcoin fell nearly 5% to below $80,000, Ether dropped 6% and BNB slid 10% after the disclosure. The incident pushed total crypto losses in 2026 above $8.7 billion, compared with $3.3 billion in 2025, according to one estimate. Critics argue the case highlights weak oversight of exchanges that hold customer assets without Wall Street-style audits or insurance. The crypto regulation debate has intensified, echoing concerns raised after the FTX collapse 2022. Some analysts suggest heavier cybersecurity investment and regulated custody as a safer alternative for retail holders.

FAQ: Binance hack and North Korea attribution

What is TraderTraitor?

TraderTraitor is a North Korean state-sponsored hacking unit linked to the Lazarus Group, known for social engineering, fake job interviews and large-scale cryptocurrency theft.

How much was stolen from Binance?

Approximately $6.3 billion across ten blockchains on 29 October 2026, making it the largest cryptocurrency heist on record.

Has Binance recovered the stolen funds?

Binance replaced 90% of stolen assets and said 98% had been replenished by 3 November, with the remainder covered by company funds.

Will Binance users lose money?

No. Binance has pledged that users will bear no financial impact and is covering the remaining less liquid tokens.

Who is investigating the Binance hack?

The FBI, U.S. Secret Service, IRS-Criminal Investigation and the UK Financial Conduct Authority are among the agencies investigating.