Binance says it replaced 90% of $6.3B stolen in hack

Binance said Saturday that it has replaced 90% of the roughly $6.3 billion in crypto stolen from its hot wallets, and that it still plans to reopen withdrawals on Sunday, Nov. 1, according to CNBC. Blockchain analysts have blamed North Korean hackers for what they describe as the largest crypto theft on record. Binance is the world's largest cryptocurrency exchange.cnbc.com

TRM Labs said an attacker moved about $6.36 billion out of Binance wallets on 10 blockchains, most of it in roughly 20 minutes. The firm attributed the attack "with high confidence" to TraderTraitor, which it called North Korea's elite hacking unit. Chainalysis CEO Jonathan Levin wrote that the hack was "likely done by DPRK group TraderTraitor." The FBI has tied the same group to the $1.5 billion Bybit hack in February 2025. North Korea denies such accusations.pbs.org+2

How the breach unfolded

The theft started around 4:05 p.m. Eastern time on Thursday, Oct. 29. The attackers had compromised laptops belonging to Binance's development and operations engineers and obtained signing authority, SBS reported. They took XRP ↘ 0.39%, Bitcoin ↗ 0.41% and Tether. Binance first pointed to a single compromised laptop. It later said its investigation had found additional "points of breach." Co-CEO Richard Teng said the attack was not carried out by one person. He said it used malicious software built to delete traces of its activity, which let the hackers move funds without passing through normal approval controls.latimes.com+2

Binance said it worked with blockchain partners to freeze roughly $3 billion of the affected assets. Yonhap reported that TRM put the frozen amount at about $2.7 billion, while the hackers still controlled roughly $2.4 billion in Bitcoin and Ethereum ↗ 0.70%. The hackers had already converted about $786 million into harder-to-trace currencies, Elliptic said, as reported by Business Insider. Asked Friday whether North Korea was involved, President Donald Trump said, "We're looking at that."en.yna.co.kr+2

Covering the losses

Binance said it has set aside about $6.34 billion of company funds. To replace the stolen assets, it is drawing on part of its Secure Asset Fund for Users (SAFU), part of its futures insurance fund and its corporate treasury, according to its recovery update. The exchange said it will rebuild SAFU to about $1 billion. The remaining 10% is made up of less liquid tokens outside its top 10, which may take longer to buy. Binance expects to complete its full proof of reserves around Nov. 3.straitstimes.com+3

TRM Labs' Ari Redbord warned that the money stolen in the attack is likely headed to Pyongyang's weapons program. "When North Korea steals at this scale, the money supports weapons proliferation, and every dollar we freeze or trace is a dollar the regime loses," he said.uk.finance.yahoo.com