Binance Hack: $6.3 Billion Theft Spurs Recovery, FBI Blames North Korea

Binance Hack: $6.3 Billion Theft Spurs Recovery, FBI Blames North Korea

by | Nov 4, 2026 | Opinion

The Binance hack, a $6.3 billion theft from the world's largest cryptocurrency exchange, unfolded late last week when attackers drained internet-connected hot wallets in roughly 20 minutes. The FBI has accused North Korea's state-backed TraderTraitor unit, and Binance said it had restored about 95% of user assets within four days of the breach.

The incident matters beyond Binance because crypto users in countries such as the US, UK and Australia have no formal deposit protection, leaving them dependent on an exchange's own resources when a platform is breached. The Binance hack has also pushed financial advisors to re-examine where crypto risk sits in client portfolios, according to InvestmentNews.

How the Binance hack unfolded

Binance estimated that about $6.36 billion in digital assets moved out of its wallets across 10 blockchains, most of it within roughly 20 minutes. More than $2.5 billion of the total was taken in a single transaction, The Guardian reported.

The exchange said the intrusion began with a compromised laptop belonging to a DevOps engineer, which let the attacker reach a service container and submit unauthorized withdrawal transactions. Binance later said its investigation uncovered additional points of breach, and co-CEO Richard Teng said the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action, according to Spiceworks.

Binance has not confirmed the initial attack method, though early reports may indicate social engineering was involved, according to Nandakumara, who cautioned that "nobody stops every social engineering lure, and the post-mortem isn't out yet." The company said there was no evidence customer wallet private keys leaked and that it expects to publish a detailed post-mortem once investigations conclude.

The theft of at least $6.3 billion shows that however sophisticated the fortifications, high-tech criminals are still finding a way in, Bloomberg reported. Aneirin Flynn, chief executive of cybersecurity firm FailSafe, called it "the largest cyber theft on record, not just the largest in crypto," according to Yahoo Finance.

North Korea blamed for the theft

The FBI formally accused the Democratic People's Republic of Korea of carrying out the Binance hack. "North Korea was responsible for the theft of more than $US6 billion in virtual assets from cryptocurrency exchange Binance," the bureau said in a statement, naming TraderTraitor, a state-backed threat actor also allegedly behind last year's $1.5 billion Bybit hack, which had previously been the largest crypto theft recorded.

The FBI said it observed the actor converting stolen Binance assets primarily into Ethereum and called on private sector entities to block transactions tied to known TraderTraitor addresses. NPR reported that researchers and law enforcement traced transactions on public blockchain ledgers to accounts they said were linked to North Korea, and that crypto firms were able to freeze more than 40% of the stolen assets.

Binance taps emergency fund to cover losses

Binance's response leaned on the Secure Asset Fund for Users, an emergency reserve it established in 2018 and financed through trading fees collected from users, designed for exactly this kind of security breach. Because the $6.3 billion in stolen assets exceeded the fund's resources, the exchange dipped into its own money to restore about 95% of user assets within four days, The Hindu reported.

The company said it had set aside more than $6.3 billion in company funds, held about $5 billion in impacted assets such as Bitcoin and Ether, and was repurchasing the remaining 5% of assets until the stolen amount is fully covered, according to Information Age. It also worked with industry partners to freeze about $3 billion of affected assets. "Bottom line – your money is safe, and we're covering every loss," co-chief executive Richard Teng said Friday.

Alongside a proof of its reserves, the company tweeted: "Our commitment is unchanged: Binance will absorb the financial impact of the stolen funds, not our users." Yi He, co-founder of Binance and longtime partner of former CEO Changpeng Zhao, said the top priority was to "ensure the environment is secure, after which users can withdraw their funds and Binance can resume operations," The Guardian reported.

Binance initially froze withdrawals, then began restoring access at approximately 5pm Sunday and started a phased resumption of withdrawals on Nov. 1. The company announced Sunday afternoon that it had processed $4.6 billion in withdrawals and $1 billion in deposits, a net outflow of about $3.6 billion, or 2.1% of its $171 billion in total assets under management.

Scams and market fallout

As Binance contained the technical damage, it faced fallout from angry and frightened users, The Guardian reported. Former CEO Changpeng Zhao warned that crypto scammers are now in "overdrive," circulating screenshots of fake recompense schemes promising $150 in free compensation for withdrawal suspensions; Binance confirmed the screenshots are digitally altered and the information false.

The Binance hack also shook traditional markets, with investors pulling funds from US Bitcoin exchange-traded funds, and shares of Coinbase, Circle and Strategy fell sharply on Oct. 30, a day after the exchange disclosed the theft. Sid Yenamandra, founder and CEO of SurgeONE.ai, noted Coinbase fell more than 13%, Circle more than 9% and Strategy about 8%, though Coinbase and Strategy had reported third-quarter earnings on Oct. 29, so some of the decline reflected company-specific results.

The name Binance was already associated with crime before the hack: Zhao pleaded guilty to violating US anti-money laundering laws in 2023 and stepped down as CEO. The Guardian described the company as facing an uphill battle to save its brand, though it's no FTX.

What the Binance hack means for policy and portfolios

The Hindu argued the Binance hack holds lessons for India, and that being a crypto exchange did not make Binance more vulnerable than a bank would have been. The lesson, the paper said, lies in how Binance prepared for and reacted to the attack, and the Indian government could mandate an industry-maintained emergency fund modeled on the exchange's reserve.

For US financial advisors, the episode is forcing a harder look at where crypto risk hides in client portfolios. "For advisors, the question is how much risk the exposure adds to the overall portfolio and whether clients are being adequately compensated for taking that risk," said Scott Dooley, chief investment officer at Sowell Management.

Dooley added a note of caution about the exchange's assurances: Binance says customer funds are safe and it will cover losses, but those are company statements, not outcomes. Unlike traditional Wall Street exchanges, platforms such as Binance serve as both trading venues and custodians of investor funds, Yahoo Finance reported.

Conclusion

The Binance hack is established as the largest cryptocurrency theft on record, with the FBI attributing the $6.3 billion breach to North Korea's TraderTraitor unit and the exchange covering about 95% of losses through its emergency fund and company resources. Binance began a phased resumption of withdrawals on Nov. 1 after processing billions in outflows. The next concrete step is the detailed post-mortem report Binance has said it will release once investigations are complete, alongside continued efforts with law enforcement and industry partners to trace, freeze and recover the remaining assets.

Frequently Asked Questions

How much was stolen in the Binance hack?

Binance estimated about $6.36 billion in digital assets was moved from its wallets across 10 blockchains, most within roughly 20 minutes. More than $2.5 billion was taken in a single transaction, making it the largest cryptocurrency theft on record, surpassing the $1.5 billion Bybit hack.

Who did the FBI blame for the $6.3 billion Binance theft?

The FBI formally accused North Korea, naming TraderTraitor, a state-backed threat actor also allegedly behind last year's $1.5 billion Bybit hack. The bureau said it observed the group converting stolen Binance assets primarily into Ethereum and urged private firms to block transactions linked to known TraderTraitor addresses.

Will Binance users get their money back after the hack?

Binance said it restored about 95% of user assets within four days, using its Secure Asset Fund for Users and company funds after the theft exceeded the fund's resources. The company said it is repurchasing the remaining 5% until the stolen amount is fully covered, and co-CEO Richard Teng pledged to cover every loss.

How did hackers break into Binance?

Binance said the attack began with a compromised laptop belonging to a DevOps engineer, which let the intruder access a service container and submit unauthorized withdrawal transactions. The exchange later said it found additional points of breach, and co-CEO Richard Teng said it was not a single one-click action. A detailed post-mortem is expected.

When did Binance resume withdrawals after the hack?

Binance initially froze withdrawals, began restoring access at approximately 5pm Sunday, and started a phased resumption on Nov. 1. It processed $4.6 billion in withdrawals and $1 billion in deposits, a net outflow of about $3.6 billion, or 2.1% of its $171 billion in assets under management.

Sources

Read Also