Binance Recovers 90% of $6.3 Billion Stolen in North Korean Cyberattack

What Happened

On Thursday, October 29, 2026, Binance, the world's largest cryptocurrency exchange, suffered a massive security breach resulting in the theft of $6.3 billion in digital assets. The company quickly initiated an investigation and began efforts to recover or replace the stolen funds. By Saturday, October 31, 2026, the Federal Bureau of Investigation (FBI) publicly attributed the unprecedented cyberattack to North Korean state-backed hackers, specifically naming the Lazarus Group, also known as TraderTraitor. This attribution was corroborated by two independent analytics firms that had previously provided intelligence to the BBC. Binance announced on Saturday that it had already covered 90% of the stolen assets, pledging to absorb the financial impact entirely and prevent user losses. The company also stated its intention to resume withdrawal services for users by Sunday, November 1, 2026, and confirmed that approximately $3 billion of the stolen assets had been frozen through collaboration with law enforcement and intelligence partners.

The hack, which involved the theft of bitcoin, ethereum, Tether, and seven other widely-traded crypto assets, is now considered the largest in cryptocurrency history, surpassing a $1.5 billion heist on the Bybit exchange in 2025, which the FBI also attributed to North Korea. Binance's co-CEO, Richard Teng, indicated that the attack was executed by multiple individuals employing sophisticated methods, including a 'self-destruct mechanism' designed to obscure their tracks. The US Secret Service also confirmed its active involvement, stating on Friday that it is 'working around the clock' with private sector partners to identify, freeze, trace, and recover the stolen funds.

What the Evidence Establishes

The evidence establishes that a $6.3 billion cryptocurrency theft occurred on Binance on Thursday, October 29, 2026. Binance has publicly committed to covering 100% of user losses, stating, 'Binance will absorb the financial impact of these stolen funds, not our users.' As of Saturday, October 31, 2026, the exchange reported having covered 90% of the stolen amount, utilizing its corporate treasury and various funds, and had set aside over $6.34 billion for this purpose. The Federal Bureau of Investigation (FBI) definitively attributed the hack to North Korea's state-backed Lazarus Group, also known as TraderTraitor, on Saturday. This attribution was supported by intelligence from two analytics firms. Furthermore, Binance, in cooperation with law enforcement and intelligence firms, successfully froze approximately $3 billion of the stolen assets by Friday, October 30, 2026. The company's initial internal investigation suggested an engineer's compromised laptop as the entry point, but later updates indicated the discovery of 'additional points of breach,' suggesting a more complex infiltration. The US Secret Service confirmed its active participation in the recovery efforts, working with private sector partners to trace and recover funds.

Where the Accounts Conflict

While the core facts of the hack, its scale, and the FBI's attribution to North Korea remain consistent across the available reports, a minor discrepancy exists in Binance's evolving understanding of the breach mechanism. Initially, Binance's internal investigation suggested that an 'engineer's laptop was compromised,' which granted unauthorized access for withdrawals. This pointed to a specific, localized point of failure. However, a subsequent update from the company indicated that they had 'uncovered additional points of breach.' This suggests a broader or more complex attack vector than initially understood, moving beyond a single compromised device to potentially multiple vulnerabilities or coordinated access points. Richard Teng, Binance's co-CEO, further elaborated on the complexity, stating the hack involved 'more than one person' and utilized 'sophisticated methods' including a 'self-destruct mechanism.' These evolving statements from Binance do not contradict the fact of the hack or its scale, but rather reflect an ongoing, deepening understanding of the attack's technical specifics and scope as their investigation progresses. The FBI's attribution to North Korea's Lazarus Group remains unchallenged by any counter-evidence in the provided sources.

Context and Stakes

This $6.3 billion hack on Binance represents the largest cryptocurrency theft in history, significantly eclipsing the previous record of a $1.5 billion heist on the Bybit exchange in 2025, which was also attributed to North Korea. The involvement of the Lazarus Group, a North Korean state-backed hacking unit, underscores a persistent and escalating pattern of state-sponsored cybercrime targeting the global cryptocurrency ecosystem. North Korea reportedly uses these illicit gains to fund its weapons programs, circumventing international sanctions. The sheer scale of this theft highlights the ongoing vulnerabilities within even the largest and most sophisticated crypto exchanges, despite their robust security claims. For Binance, a company estimated to have hundreds of millions of users worldwide, the immediate stakes involve maintaining user trust and demonstrating its capacity for rapid recovery and reimbursement. Its pledge to cover 100% of losses and the swift action to freeze $3 billion in stolen assets are critical steps in mitigating reputational damage and preventing a mass exodus of users. The incident also intensifies scrutiny on global cybersecurity measures and international cooperation against state-sponsored cyber warfare, particularly as it pertains to financial infrastructure.

What to Watch Next

The immediate focus will be on Binance's ability to fully restore withdrawal services for all users as pledged, with the company targeting Sunday, November 1, 2026, for reopening. Any delays or further complications in this process could significantly impact user confidence and potentially trigger market volatility for associated cryptocurrencies. Observers should also monitor the ongoing investigation by Binance, the FBI, and the US Secret Service for further details regarding the 'additional points of breach' and the specific mechanisms employed by the Lazarus Group. The recovery of the remaining 10% of stolen funds, approximately $630 million, will be a key indicator of the effectiveness of these collaborative law enforcement efforts. Furthermore, the international community will be watching for potential diplomatic or economic responses to North Korea following the FBI's definitive attribution. This could include new sanctions or intensified efforts to disrupt North Korea's cyber capabilities. The broader cryptocurrency market will also be under scrutiny for any sustained impact on investor sentiment or regulatory shifts in response to this record-breaking security incident.

Bottom Line

Binance, the world's largest crypto exchange, experienced a $6.3 billion hack on Thursday, October 29, 2026, which the FBI has attributed to North Korea's Lazarus Group. The company has committed to fully reimburse all affected users, having already covered 90% of the losses and setting aside over $6.34 billion for this purpose. Approximately $3 billion of the stolen assets have been frozen through collaborative efforts with law enforcement. This incident marks the largest cryptocurrency theft in history and underscores the persistent threat posed by state-sponsored cyberattacks to global financial systems. Binance aims to resume user withdrawal services by Sunday, November 1, 2026, as investigations into the sophisticated breach continue. The event highlights critical vulnerabilities in digital asset security and will likely prompt intensified international efforts to counter North Korean cyber operations and enhance regulatory oversight within the cryptocurrency sector.