Binance Hack: $6.3 Billion Theft Spurs Recovery, FBI Blames North Korea

Binance Hack: $6.3 Billion Theft Spurs Recovery, FBI Blames North Korea

by | Nov 4, 2026 | Opinion

The Binance hack, a $6.3 billion theft from the world's largest cryptocurrency exchange, unfolded late last week when attackers drained internet-connected hot wallets in roughly 20 minutes. The FBI has accused North Korea's state-backed TraderTraitor unit, and Binance said it had restored about 95% of user assets within four days of the breach.

The incident matters beyond Binance because crypto users in countries such as the US, UK and Australia have no formal deposit protection, leaving them dependent on an exchange's own resources when a platform is breached. The Binance hack has also pushed financial advisors to re-examine where crypto risk sits in client portfolios, according to InvestmentNews.

How the Binance hack unfolded

Binance estimated that about $6.36 billion in digital assets moved out of its wallets across 10 blockchains, most of it within roughly 20 minutes. More than $2.5 billion of the total was taken in a single transaction, The Guardian reported.

The exchange said the intrusion began with a compromised laptop belonging to a DevOps engineer, which let the attacker reach a service container and submit unauthorized withdrawal transactions. Binance later said its investigation uncovered additional points of breach, and co-CEO Richard Teng said the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action, according to Spiceworks.

Binance has not confirmed the initial attack method, though early reports may indicate social engineering was involved, according to Nandakumara, who cautioned that "nobody stops every social engineering lure, and the post-mortem isn't out yet." The company said there was no evidence customer wallet private keys leaked and that it expects to publish a detailed post-mortem once investigations conclude.

The theft of at least $6.3 billion shows that however sophisticated the fortifications, high-tech criminals are still finding a way in, Bloomberg reported. Aneirin Flynn, chief executive of cybersecurity firm FailSafe, called it "the largest cyber theft on record, not just the largest in crypto," according to Yahoo Finance.

North Korea blamed for the theft

The FBI formally accused the Democratic People's Republic of Korea of carrying out the Binance hack. "North Korea was responsible for the theft of more than $US6 billion in virtual assets from cryptocurrency exchange Binance," the bureau said in a statement, naming TraderTraitor, a state-backed threat actor also allegedly behind last year's $1.5 billion Bybit hack, which had previously been the largest crypto theft recorded.

The FBI said it observed the actor converting stolen Binance assets primarily into Ethereum and called on private sector entities to block transactions tied to known TraderTraitor addresses. NPR reported that researchers and law enforcement traced transactions on public blockchain ledgers to accounts they said were linked to North Korea, and that crypto firms were able to freeze more than 40% of the stolen assets.

Binance taps emergency fund to cover losses

Binance's response leaned on the Secure Asset Fund for Users, an emergency reserve it established in 2018 and financed through trading fees collected from users, designed for exactly this kind of security breach. Because the $6.3 billion in stolen assets exceeded the fund's resources, the exchange dipped into its own money to restore about 95% of user assets within four days, The Hindu reported.

The company said it had set aside more than $6.3 billion in company funds, held about $5 billion in impacted assets such as Bitcoin and Ether, and was repurchasing the remaining 5% of assets until the stolen amount is fully covered, according to Information Age. It also worked with industry partners to freeze about $3 billion of affected assets. "Bottom line – your money is safe, and we're covering every loss," co-chief executive Richard Teng said Friday.

Alongside a proof of its reserves, the company tweeted: "Our commitment is unchanged: Binance will absorb the financial impact of the stolen funds, not our users." Yi He, co-founder of Binance and longtime partner of former CEO Changpeng Zhao, said the top priority was to "ensure the environment is secure, after which users can withdraw their funds and Binance can resume operations," The Guardian reported.

Binance initially froze withdrawals, then began restoring access at approximately 5pm Sunday and started a phased resumption of withdrawals on Nov. 1. The company announced Sunday afternoon that it had processed $4.6 billion in withdrawals and $1 billion in deposits, a net outflow of about $3.6 billion, or 2.1% of its $171 billion in total assets under management.

Scams and market fallout

As Binance contained the technical damage, it faced fallout from angry and frightened users, The Guardian reported. Former CEO Changpeng Zhao warned that crypto scammers are now in "overdrive," circulating screenshots of fake recompense schemes promising $150 in free compensation for withdrawal suspensions; Binance confirmed the screenshots are digitally altered and the information false.

The Binance hack also shook traditional markets, with investors pulling funds from US Bitcoin exchange-traded funds, and shares of Coinbase, Circle and Strategy fell sharply on Oct. 30, a day after the exchange disclosed the theft. Sid Yenamandra, founder and CEO of SurgeONE.ai, noted Coinbase fell more than 13%, Circle more than 9% and Strategy about 8%, though Coinbase and Strategy had reported third-quarter earnings on Oct. 29, so some of the decline reflected company-specific results.

The name Binance was already associated with crime before the hack: Zhao pleaded guilty to violating US anti-money laundering laws in 2023 and stepped down as CEO. The Guardian described the company as facing an uphill battle to save its brand, though it's no FTX.

What the Binance hack means for policy and portfolios

The Hindu argued the Binance hack holds lessons for India, and that being a crypto exchange did not make Binance more vulnerable than a bank would have been. The lesson, the paper said, lies in how Binance prepared for and reacted to the attack, and the Indian government could mandate an industry-maintained emergency fund modeled on the exchange's reserve.

For US financial advisors, the episode is forcing a harder look at where crypto risk hides in client portfolios. "For advisors, the question is how much risk the exposure adds to the overall portfolio and whether clients are being adequately compensated for taking that risk," said Scott Dooley, chief investment officer at Sowell Management.

Dooley added a note of caution about the exchange's assurances: Binance says customer funds are safe and it will cover losses, but those are company statements, not outcomes. Unlike traditional Wall Street exchanges, platforms such as Binance serve as both trading venues and custodians of investor funds, Yahoo Finance reported.

Conclusion

The Binance hack is established as the largest cryptocurrency theft on record, with the FBI attributing the $6.3 billion breach to North Korea's TraderTraitor unit and the exchange covering about 95% of losses through its emergency fund and company resources. Binance began a phased resumption of withdrawals on Nov. 1 after processing billions in outflows. The next concrete step is the detailed post-mortem report Binance has said it will release once investigations are complete, alongside continued efforts with law enforcement and industry partners to trace, freeze and recover the remaining assets.

Frequently Asked Questions

How much was stolen in the Binance hack?

Binance estimated about $6.36 billion in digital assets was moved from its wallets across 10 blockchains, most within roughly 20 minutes. More than $2.5 billion was taken in a single transaction, making it the largest cryptocurrency theft on record, surpassing the $1.5 billion Bybit hack.

Who did the FBI blame for the $6.3 billion Binance theft?

The FBI formally accused North Korea, naming TraderTraitor, a state-backed threat actor also allegedly behind last year's $1.5 billion Bybit hack. The bureau said it observed the group converting stolen Binance assets primarily into Ethereum and urged private firms to block transactions linked to known TraderTraitor addresses.

Will Binance users get their money back after the hack?

Binance said it restored about 95% of user assets within four days, using its Secure Asset Fund for Users and company funds after the theft exceeded the fund's resources. The company said it is repurchasing the remaining 5% until the stolen amount is fully covered, and co-CEO Richard Teng pledged to cover every loss.

How did hackers break into Binance?

Binance said the attack began with a compromised laptop belonging to a DevOps engineer, which let the intruder access a service container and submit unauthorized withdrawal transactions. The exchange later said it found additional points of breach, and co-CEO Richard Teng said it was not a single one-click action. A detailed post-mortem is expected.

When did Binance resume withdrawals after the hack?

Binance initially froze withdrawals, began restoring access at approximately 5pm Sunday, and started a phased resumption on Nov. 1. It processed $4.6 billion in withdrawals and $1 billion in deposits, a net outflow of about $3.6 billion, or 2.1% of its $171 billion in assets under management.

Sources

Read Also

Binance Hack: $6.3 Billion Theft Tests Crypto’s Credibility

Binance Hack: $6.3 Billion Theft Tests Crypto’s Credibility

by | Nov 4, 2026 | Opinion

The Binance hack on October 29 drained roughly $6.3 billion from the world's largest cryptocurrency exchange, making it the biggest crypto theft on record. Attackers moved about $6.36 billion out of Binance wallets across 10 blockchains, most of it in roughly 20 minutes, according to Spiceworks.

The Binance hack matters because it forces the industry to answer a question it has long avoided: what happens to customers when something goes wrong. The exchange has pledged to absorb the loss itself rather than pass it to users, a response that PYMNTS described as the real test for institutional investors watching how the sector handles its worst days.

How the Binance hack unfolded

Binance described the operation as a sophisticated, multi-stage campaign that began in June 2026 and ran for several months, according to Shattered. The company's account, relayed by outlets including The New York Times, ABC News and The Verge, forms the backbone of the public record.

In September 2026, a person posing as a project director contacted a Binance software engineer through a job-hunting platform and instructed the engineer to download an interview assignment, Binance said. That assignment was what the company called a malicious code repository, and the approach came through a recruiting site rather than a phishing email, according to NPR's account of Binance's statement.

Binance said the code used "sophisticated obfuscation and evasion techniques" and swapped a legitimate development-tool component for a malicious version. The company's security tools did not detect the file, a detail The New York Times highlighted in quoting Binance's own description.

The attackers did not stop at one target. A second software engineer was approached for a fictitious job and took part in multiple interview interactions, including a virtual meeting with someone claiming to be the CEO of a fictitious company, Binance said.

Once inside, the attackers used Binance's internal artificial intelligence tool to gain control over wallet systems, the company said. The reporting does not identify which product that was, how it connected to wallet systems or what permissions it held, and Shattered treated any specific claim about its design as unconfirmed.

Competing explanations for the breach

Binance initially pointed to a compromised engineer's laptop as the source of the hack, then clarified that multiple factors contributed to the breach, BusinessDesk reported. The company's first statement said the incident "may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," and added that it found no evidence of a wallet private-key leak, according to Spiceworks.

Binance later said its investigation had uncovered additional points of breach. Co-CEO Richard Teng said the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action.

The emerging evidence points to hijacked transaction authorisation systems rather than any failure of bitcoin's underlying cryptography, BusinessDesk reported. Zelazny, quoted by Spiceworks, noted that "authentication does not equate to authorization."

The FBI attributed the attack to TraderTraitor, described as a North Korea-affiliated hacking unit, according to Shattered. Binance has given dates for only some stages of the campaign, leaving parts of the timeline undated.

Binance absorbs the loss

By Sunday, November 1, Binance said it had covered about 95% of the stolen assets by buying replacement tokens with company money. The remaining balance involved less liquid cryptocurrencies that were harder to acquire quickly, BusinessDesk reported.

The exchange drew on its corporate treasury, its customer protection reserve and part of its futures insurance fund. Binance had committed more than $6.34 billion to cover the shortfall, Crypto Reporter reported, and CoinDesk reported that Binance already held about $5 billion in the affected tokens while acquiring the rest through public markets and over-the-counter transactions.

Binance's SAFU protection fund was worth about $1 billion, and the company said it would use half of it and replenish it, BusinessDesk reported. The theft was more than six times the fund's size, so the wider balance sheet had to pick up the slack.

Binance has maintained that customer balances would not be affected and pledged to bear the financial cost of the incident. BusinessDesk argued that commitment is precisely what customers should expect, while also noting that compensating users after a security failure is different from showing assets were properly protected in the first place.

Withdrawals resume and outflows spike

Binance began reopening withdrawals for selected cryptocurrencies on Sunday after temporarily suspending them for security checks, Crypto Reporter reported. Customers initially rushed to move funds out, and the exchange recorded more than $3.5 billion in net outflows on Sunday, according to DefiLlama data cited by Reuters.

BusinessDesk put the figure at roughly $3.64 billion in net outflows, about 2.1% of Binance's assets, after withdrawals resumed. PYMNTS reported that customers had withdrawn north of $4.7 billion by November 2. Binance said withdrawal activity spiked at the beginning but was declining toward normal levels.

Most Binance users, across about 335 million accounts worldwide, apparently store their tokens offline in cold wallets, leaving smaller holdings on the exchange for liquidity, BusinessDesk reported. For Kiwi users, who may number in the hundreds of thousands, the immediate reassurance is the company's promise to absorb the loss.

Stablecoin freezes and the recovery effort

Tether and Circle, the two leading stablecoin issuers, collectively froze about $3 billion in tokens stolen from Binance, PYMNTS reported Friday. Issuer-controlled stablecoins retain an avenue for intervention after funds leave an exchange, and the frozen funds are separate from Binance's own reserves and may not all be recoverable, Crypto Reporter noted.

The Genius Act established a federal framework for payment stablecoins, which were involved in the hack but are recoverable because providers such as Tether and Circle could freeze about $3 billion worth of stolen tokens, BusinessDesk reported. Jardine, quoted by PYMNTS, observed that "a court order alone cannot make the bitcoin network transfer coins."

The Binance hack dwarfs the roughly $1.5 billion stolen from Bybit in February 2025, the previous benchmark, PYMNTS reported. Binance puts the theft at approximately $6.3 billion, while other reports cited $6.34 billion or $6.6 billion, according to Shattered.

What the Binance hack means for crypto

The industry's largest players have developed the financial muscle to survive a catastrophe, BusinessDesk argued, but they still cannot convincingly explain why ordinary people should expose their savings to one. PYMNTS reached a similar conclusion, writing that the breach reveals how crypto's financial footprint has outgrown its institutional safeguards.

Emergency reserves, asset freezes and corporate funds helped contain the damage, but crypto still lacks standardized mechanisms to absorb losses and restore liquidity, according to PYMNTS. The arrangements governing who supplies liquidity, freezes assets, compensates customers and absorbs residual losses remain far less uniform than the infrastructure for moving digital assets.

Binance carries a chequered history into this crisis. Its founder Changpeng Zhao served a four-month prison sentence in the United States in 2024 after allowing his platform to be used for money laundering, BusinessDesk reported.

For Binance, the incident is now as much a test of trust as it is a financial challenge, Crypto Reporter wrote. The obvious question is not whether Binance can survive this attack, BusinessDesk argued, but whether the episode changes what customers demand from the platforms holding their money.

Conclusion

The Binance hack is the largest cryptocurrency theft on record, and the exchange has covered about 95% of the stolen assets using its corporate treasury, customer protection reserve and futures insurance fund. Withdrawals have resumed, outflows have slowed from their initial spike, and Tether and Circle have frozen about $3 billion in stolen stablecoins.

The next concrete step is Binance's effort to acquire the remaining less liquid tokens and replenish its SAFU fund while investigators pursue recovery of the full amount stolen. Whether the episode pushes the industry toward standardized mechanisms for absorbing losses remains the open question the facts leave unresolved.

Frequently Asked Questions

How much was stolen in the Binance hack on October 29, 2026?

Binance puts the theft at approximately $6.3 billion, with other reports citing $6.34 billion or $6.6 billion. Attackers moved about $6.36 billion out of Binance wallets across 10 blockchains, most of it in roughly 20 minutes, making it the largest cryptocurrency theft on record.

How did attackers get into Binance's systems?

Binance says a person posing as a project director contacted a software engineer through a job-hunting platform in September 2026 and instructed the engineer to download an interview assignment that was a malicious code repository. The attackers later used Binance's internal AI tool to gain control over wallet systems.

Will Binance customers lose money from the hack?

Binance has pledged to bear the full financial cost and says customer balances will not be affected. By Sunday, November 1, the exchange said it had replaced about 95% of the stolen assets using company funds, drawing on its corporate treasury, customer protection reserve and futures insurance fund.

Who carried out the Binance hack?

The FBI attributed the attack to TraderTraitor, described as a North Korea-affiliated hacking unit. Binance described the operation as a sophisticated, multi-stage campaign that began in June 2026 and involved months of preparation, including fictitious job interviews targeting its engineers.

How much of the stolen crypto has been recovered or frozen?

Tether and Circle collectively froze about $3 billion in stolen tokens, an intervention possible because issuer-controlled stablecoins retain a freeze mechanism after funds leave an exchange. The frozen funds are separate from Binance's own reserves and may not all be recoverable.

Sources

Read Also