North Korea-linked hackers reportedly stole $6.3 billion in cryptocurrency from the world’s largest crypto exchange. Binance says it has replenished 90% of the stolen assets, pledged to cover the remaining losses and restored withdrawals across several networks. Here’s how the attack happened, who is behind it, what Binance is doing and what comes next.
Binance, the world’s largest cryptocurrency exchange, is dealing with one of the biggest cybersecurity incidents in the history of digital assets after hackers stole approximately $6.3 billion (£4.7 billion) in cryptocurrency on Thursday, October 29, 2026. The attack has been attributed by the US Federal Bureau of Investigation (FBI) to North Korea-linked cybercriminals, raising fresh concerns about the security of centralised cryptocurrency exchanges and the growing sophistication of international hacking operations.
The attackers reportedly compromised Binance’s internal wallet infrastructure and transferred billions of dollars in digital assets across multiple blockchain networks. The scale of the theft has made it the largest reported cryptocurrency hack on record, surpassing the previous record of approximately $1.5 billion stolen from cryptocurrency exchange Bybit in February 2025.
Binance has repeatedly assured customers that it will absorb the financial impact of the incident rather than pass the losses on to users. The company initially announced that it had set aside more than $6.34 billion in corporate funds to replace the stolen assets.
In an update released on Saturday, October 31, Binance said it had already covered approximately 90% of the affected assets. The remaining 10% may take longer to source in the required quantities, particularly because some of the stolen tokens have limited liquidity.
The exchange also announced on Sunday, November 1, that withdrawals had been restored across several of its blockchain networks following temporary suspensions introduced after the attack. The restoration is taking place in phases as the company continues its security checks.
Meanwhile, the FBI has officially attributed the incident to North Korea and warned cryptocurrency businesses about attempts to launder the stolen assets through Ethereum, decentralised finance platforms and instant cryptocurrency swap services.
The incident has triggered questions about how hackers managed to access such a significant amount of cryptocurrency, whether customer funds are safe and how much of the stolen money can eventually be recovered.
Here’s everything you need to know about the Binance hack.
1. What Happened in the Binance Hack?
The Binance hack took place on Thursday, October 29, 2026, when attackers gained unauthorised access to systems associated with the exchange’s hot wallets.
The incident resulted in the theft of approximately $6.3 billion worth of cryptocurrency, making it the largest reported cryptocurrency exchange breach in history.
According to preliminary findings, the attackers targeted Binance’s internal infrastructure rather than individual customer accounts. They reportedly exploited weaknesses in systems responsible for managing and authorising cryptocurrency transactions.
The attack involved multiple blockchain networks, with hackers transferring digital assets into addresses under their control. The movement of funds reportedly began at approximately 20:05 UTC, with a substantial portion of the transactions executed within a relatively short period.
Binance initially identified a potentially compromised laptop belonging to a DevOps engineer as one of the possible entry points. The attackers allegedly used access obtained through the device to enter a service container and submit unauthorised withdrawal transactions.
However, the company’s subsequent investigation identified additional points of compromise, indicating that the operation may have involved multiple vulnerabilities.
Binance said it had found no evidence that wallet private keys had been leaked. Nevertheless, the attackers managed to exploit weaknesses in the systems surrounding transaction authorisation and wallet operations.
Following the discovery, Binance immediately began containing the affected infrastructure, revoking compromised authorisations and coordinating with external security experts.
The exchange also temporarily suspended withdrawals on affected networks to prevent further unauthorised transactions while its security teams investigated the breach.
2. How Did Hackers Steal $6.3 Billion From Binance?
The technical details of the attack suggest that the hackers exploited internal access and transaction authorisation mechanisms rather than relying on conventional phishing attacks against customers.
Hot wallets are cryptocurrency wallets connected to the internet. Exchanges use them to facilitate regular customer transactions, including deposits and withdrawals. Their connectivity allows platforms to process transactions quickly, but it also makes them potential targets for cybercriminals.
In the Binance incident, attackers reportedly gained access to internal systems through a compromised employee device.
A DevOps engineer’s laptop was suspected to have been compromised, allowing the attackers to access a service container connected to Binance’s infrastructure. From there, they allegedly obtained the ability to submit unauthorised withdrawal transactions.
Blockchain intelligence firm TRM Labs identified a particularly sophisticated technique used on the Ethereum network.
The attackers reportedly exploited the EIP-7702 delegation mechanism, which allows externally owned accounts to temporarily use smart-contract functionality.
Investigators said the hackers used this mechanism to turn an affected Binance hot wallet into a sweeper wallet under their control. The operation reportedly involved 50 pre-signed authorisations prepared in advance.
On other blockchain networks, attackers used signed transfers to move assets into wallets they controlled.
The coordinated transactions suggest that the operation had been carefully prepared before execution.
An important distinction is that Binance has not confirmed that its private keys were stolen. Instead, the initial findings suggest that attackers exploited weaknesses in the infrastructure and processes surrounding wallet operations.
The incident demonstrates that cryptocurrency security involves much more than protecting private keys. Employee devices, access permissions, software environments and transaction verification systems are equally important.
Binance is expected to publish a more comprehensive technical post-mortem explaining the vulnerabilities and the complete sequence of events.
3. Who Is Behind the Binance Hack?
The FBI has officially attributed the Binance attack to North Korea-linked cybercriminals.
In a statement released on Saturday, October 31, the agency identified the responsible operation as TraderTraitor, a hacking group associated with North Korea’s cyber activities.
The FBI also published cryptocurrency addresses connected to the incident and asked cryptocurrency exchanges, decentralised finance platforms and other digital asset service providers to block transactions involving those addresses.
TraderTraitor has been associated with previous cyberattacks targeting cryptocurrency exchanges, blockchain infrastructure and digital asset businesses.
North Korean-linked hacking groups have increasingly become a concern for the cryptocurrency industry because of their involvement in high-value digital asset thefts.
These operations frequently involve compromised employee devices, sophisticated social engineering, malicious software and vulnerabilities in transaction infrastructure.
The stolen cryptocurrency can subsequently be moved through multiple wallets, exchanged for other tokens or transferred through decentralised platforms to make it harder for investigators to trace.
The FBI said it had observed the attackers converting stolen assets primarily into Ethereum. It expects the hackers to use decentralised finance platforms and instant swap services to convert the cryptocurrency again as part of their laundering efforts.
The agency’s attribution is significant because it connects the Binance incident to a broader pattern of cryptocurrency-related cybercrime.
However, identifying the responsible hacking group does not necessarily mean that investigators have identified every individual involved or established the full chain of command behind the operation.
The FBI is continuing to work with private-sector organisations to restrict the movement of the stolen assets.
4. How Much Money Was Stolen From Binance?
The estimated value of the cryptocurrency stolen in the attack is approximately $6.3 billion, equivalent to around £4.7 billion.
The figure makes the incident significantly larger than previous major cryptocurrency thefts.
The attackers reportedly transferred assets across 10 blockchain networks, using multiple cryptocurrency addresses to distribute the stolen funds.
The affected assets included major cryptocurrencies and stablecoins, including Bitcoin, Ethereum, USDT, USDC and BNB, among others.
However, the exact valuation of the stolen cryptocurrency can fluctuate because digital asset prices change continuously.
The attackers’ subsequent conversion of the assets into other cryptocurrencies also complicates the process of calculating their current value.
Investigators are now monitoring the movement of funds across blockchain networks and attempting to identify transactions connected to the original stolen assets.
The scale of the incident has also raised concerns about the financial exposure of centralised cryptocurrency exchanges and the potential consequences of a major infrastructure compromise.
5. Binance Says It Has Replenished 90% of the Stolen Assets
One of the biggest developments following the attack is Binance’s announcement that it has already replenished approximately 90% of the affected assets.
The company has consistently maintained that customers will not bear the financial consequences of the incident.
In its Saturday statement, Binance said it had set aside more than $6.34 billion in company funds to cover the losses.
The exchange also confirmed that it was purchasing the remaining cryptocurrency required to restore the affected asset balances.
The company said in its statement, “Binance will absorb the financial impact of these stolen funds, not our users.”
The remaining 10% may take longer to acquire because some of the affected tokens are less liquid and cannot be sourced immediately in the required quantities.
This distinction is important because replenishing the stolen assets does not mean the hackers have returned the original cryptocurrency.
Instead, Binance is using its own financial resources to replace the value of the stolen holdings.
The company has reportedly completed the replenishment of several major cryptocurrencies, including Bitcoin, Ethereum, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD and ZEC.
The exchange has said it will continue purchasing the outstanding tokens until the entire amount is covered.
This approach is intended to maintain customer balances and prevent the security incident from becoming a direct financial loss for users.
6. What Is Binance’s SAFU Fund?
Binance’s response also involves its Secure Asset Fund for Users, commonly known as SAFU.
The emergency reserve was established in July 2018 to provide additional financial protection for customers during extreme situations, including security breaches and other unexpected incidents.
Binance has historically allocated a portion of its trading fees towards building the fund.
The reserve is designed to provide a financial safety net when the exchange faces circumstances that could otherwise affect customer assets.
Following the $6.3 billion theft, Binance announced that it would use a combination of corporate treasury resources and SAFU funds to address the financial impact.
The company also committed to rebuilding SAFU to approximately $1 billion after deploying a portion of the reserve for the recovery effort.
This is particularly important because cryptocurrency transactions are generally irreversible once confirmed on their respective blockchain networks.
Unlike traditional banking systems, there is no universal authority capable of reversing every unauthorised cryptocurrency transfer.
An emergency reserve can therefore help an exchange replace affected assets without depending entirely on recovering the stolen cryptocurrency.
Binance’s decision to absorb the losses is intended to demonstrate that its customers will remain financially protected despite the security breach.
7. How Much of the Stolen Cryptocurrency Has Been Frozen?
Binance has been working with law enforcement agencies, blockchain intelligence companies and cryptocurrency issuers to track and restrict the movement of stolen funds.
According to the exchange’s earlier security update, approximately $3 billion worth of affected assets had been frozen through cooperation with industry partners.
However, freezing cryptocurrency does not necessarily mean that the money has been permanently recovered.
Certain stablecoin issuers have the ability to blacklist specific wallet addresses, preventing the movement of tokens held in those addresses.
Decentralised cryptocurrencies such as Bitcoin operate differently because there is no central issuer with the authority to freeze individual wallets.
This creates additional challenges for investigators attempting to recover stolen digital assets.
The FBI has also released cryptocurrency addresses associated with the attack and asked service providers to block transactions involving those addresses.
The agency believes that the attackers may attempt to convert the stolen cryptocurrency into different assets using decentralised finance platforms and instant swap services.
These services can complicate investigations because funds may move between multiple blockchain networks and wallet addresses.
The cooperation between Binance, cryptocurrency issuers and law enforcement agencies will therefore play an important role in determining how much of the original stolen cryptocurrency can eventually be recovered.
8. Binance Restores Withdrawals After the Hack
Another major development came on Sunday, November 1, when Binance announced that withdrawals had been restored on several of its networks.
The exchange had temporarily suspended withdrawals following the attack as a precautionary security measure.
The suspension was introduced to give security teams time to investigate the breach, revoke compromised permissions and ensure that the affected infrastructure could safely process transactions.
Binance had previously said withdrawals would resume in phases rather than being restored across all networks simultaneously.
The phased approach allows the company to validate individual systems and monitor their performance before returning to normal operations.
The restoration of withdrawals is an important development for customers who were concerned about their ability to access and transfer their cryptocurrency holdings.
However, the exchange’s security investigation is continuing, and the restoration of withdrawal services does not mean that the original stolen assets have been recovered.
The company must continue monitoring its systems, strengthening access controls and ensuring that the vulnerabilities identified during the incident have been addressed.
The move is also an important step towards restoring customer confidence following one of the largest reported security breaches in cryptocurrency history.
9. Why Is the FBI Warning About Ethereum Conversions?
The FBI has specifically warned that the hackers have been converting stolen cryptocurrency into Ethereum.
Ethereum is one of the world’s largest blockchain networks and supports a broad ecosystem of decentralised applications, cryptocurrency exchanges and financial services.
Its extensive ecosystem makes it possible to exchange digital assets, interact with smart contracts and move tokens between different services.
According to the FBI, the attackers have already been converting stolen assets into Ethereum and may subsequently use decentralised finance platforms and instant swap services to convert the funds again.
This process could make the stolen assets harder to trace and potentially complicate recovery efforts.
Decentralised finance platforms allow users to access financial services through blockchain-based smart contracts rather than relying entirely on traditional financial intermediaries.
Instant swap services, meanwhile, allow users to exchange one cryptocurrency for another without necessarily using a conventional centralised exchange.
Although these services have legitimate uses, they can also be exploited by cybercriminals attempting to move stolen cryptocurrency.
The FBI’s warning is intended to encourage service providers to monitor suspicious transactions and prevent identified stolen assets from being processed through their platforms.
The agency has asked cryptocurrency businesses to cooperate with investigators and use the published wallet addresses to identify potentially related transactions.
10. How Does the Binance Hack Compare With Previous Crypto Heists?
The Binance incident has surpassed several previous cryptocurrency thefts in terms of reported financial losses.
Before the October 2026 attack, the February 2025 Bybit hack was widely recognised as the largest cryptocurrency exchange theft, involving approximately $1.5 billion.
The Binance incident is more than four times that amount.
| Cryptocurrency incident | Year | Estimated amount stolen |
| Binance | 2026 | $6.3 billion |
| Bybit | 2025 | $1.5 billion |
| Ronin Network | 2022 | $625 million |
| Poly Network | 2021 | $611 million |
| Coincheck | 2018 | $530 million |
The incidents involved different attack methods and security vulnerabilities.
The Ronin Network attack involved compromised validator credentials, while the Poly Network breach exploited weaknesses in cross-chain smart-contract infrastructure.
The Bybit attack was attributed to North Korea-linked hackers and involved a compromise of its transaction-signing process.
The Binance incident has once again highlighted the risks associated with internal systems responsible for authorising cryptocurrency transactions.
The comparison also demonstrates how the financial consequences of a single security failure have grown alongside the cryptocurrency industry.
11. Are Binance Customer Funds Safe?
One of the biggest concerns among Binance customers following the incident has been whether their cryptocurrency holdings are safe.
The exchange has repeatedly stated that it will cover the losses using its own financial resources and emergency reserves.
Its commitment to replenish 100% of the affected assets is intended to ensure that customers do not face direct financial losses from the incident.
Binance’s reported replenishment of approximately 90% of the stolen assets represents a significant step towards fulfilling that commitment.
However, customers should understand the distinction between the financial backing of their balances and their ability to access cryptocurrency during a security emergency.
Even if customer holdings remain fully backed, an exchange may temporarily suspend withdrawals while investigating suspicious activity.
This is what happened following the Binance attack.
The temporary suspension demonstrated how users can become dependent on an exchange’s operational decisions during a cybersecurity incident.
The restoration of withdrawals across several networks on Sunday is therefore an important development.
Binance is also preparing an updated Proof of Reserves report to provide additional information about its holdings and customer liabilities.
While these measures may help restore confidence, the long-term impact will depend on the company’s ability to demonstrate that the vulnerabilities responsible for the breach have been addressed.
12. What Is Proof of Reserves?
Proof of Reserves is a verification mechanism used by cryptocurrency exchanges to demonstrate that they hold sufficient digital assets to support customer balances.
Following major cryptocurrency exchange failures and security incidents, reserve transparency has become increasingly important for investors.
Binance has announced that it will publish an updated Proof of Reserves report following the October 2026 attack.
The report is expected to provide information about the exchange’s cryptocurrency holdings and the corresponding customer liabilities.
Many exchanges use cryptographic techniques such as Merkle trees to allow customers to verify whether their balances are included in the reported liabilities.
A Merkle tree combines multiple records into a single cryptographic structure, allowing individual records to be checked without publicly disclosing every customer’s financial information.
However, Proof of Reserves is not the same as a complete independent financial audit.
It does not automatically establish the exchange’s overall financial health, reveal every potential liability or guarantee that its infrastructure is protected against future cyberattacks.
For Binance, the updated report will be an important part of demonstrating that customer assets remain adequately backed following the theft.
13. What Does the Binance Hack Mean for Cryptocurrency Investors?
The incident could encourage cryptocurrency investors to reconsider how they store and manage their digital assets.
Centralised exchanges make cryptocurrency trading convenient by allowing customers to buy, sell and hold different digital currencies through a single platform.
However, users who leave their cryptocurrency on an exchange depend on that platform’s security systems and operational infrastructure.
A major breach can therefore create problems even when customer balances are not directly affected.
The Binance incident demonstrates that investors may temporarily lose access to their assets when an exchange suspends withdrawals during an investigation.
Some investors may consequently consider self-custody options, including hardware wallets that allow them to maintain control of their private keys.
Hardware wallets generally store private keys offline, reducing exposure to certain internet-based attacks.
However, self-custody also introduces risks. Losing a private key or recovery phrase can result in permanent loss of cryptocurrency.
Investors must therefore understand the advantages and limitations of different storage methods before making decisions about their holdings.
The incident does not establish that all centralised cryptocurrency exchanges are unsafe. However, it reinforces the importance of examining exchange security practices, reserve disclosures and withdrawal policies.
14. What Happens Next in the Binance Investigation?
The investigation will now focus on recovering stolen cryptocurrency, identifying the attackers’ methods and preventing similar incidents.
The FBI’s attribution of the attack to TraderTraitor provides investigators with an important starting point.
The agency has already identified cryptocurrency addresses associated with the operation and asked service providers to restrict transactions involving those addresses.
Binance, meanwhile, must complete the replenishment of the remaining 10% of affected assets.
The exchange has said that sourcing these tokens may take longer because of limited liquidity.
It must also continue restoring withdrawal services across affected blockchain networks and demonstrate that its infrastructure can operate securely.
Another important development will be the publication of Binance’s updated Proof of Reserves report and its detailed technical post-mortem.
These disclosures could provide customers and industry observers with a clearer understanding of the scale of the breach and the security measures being introduced.
The recovery of the original stolen cryptocurrency remains uncertain. Although approximately $3 billion in affected assets was reportedly frozen through industry cooperation, investigators still face challenges in tracking funds across different blockchain networks.
The FBI’s warning about Ethereum conversions and decentralised financial services suggests that monitoring the attackers’ transactions will remain a priority.
The Bigger Picture: A Major Test for Cryptocurrency Security
The $6.3 billion Binance hack represents a significant challenge for the cryptocurrency industry and its efforts to establish trust in digital financial infrastructure.
The attack has demonstrated that even the world’s largest cryptocurrency exchange can face serious vulnerabilities within its internal systems.
It has also highlighted the growing role of international cybercriminal networks in targeting digital assets.
Binance’s commitment to cover 100% of the losses and its announcement that approximately 90% of the affected assets have already been replenished could help limit the immediate financial consequences for customers.
The restoration of withdrawals across several networks on Sunday is another important step towards normalising operations.
However, replacing stolen assets does not mean recovering the original cryptocurrency. Investigators must still determine how much of the money can be traced, frozen and ultimately returned.
The incident also raises broader questions about the security of centralised exchanges, the effectiveness of emergency reserves and the ability of international law enforcement agencies to respond to cryptocurrency-related cybercrime.
For Binance, the coming weeks will be crucial. The company must complete the replenishment process, publish its security findings and demonstrate that the vulnerabilities responsible for the breach have been addressed.
For the wider cryptocurrency industry, the incident serves as a reminder that protecting digital assets requires continuous investment in cybersecurity, internal controls and cooperation between platforms.
Ultimately, the Binance hack will be remembered not only for its extraordinary financial scale but also for the questions it raises about the future security of the global cryptocurrency ecosystem.
