Binance, the world's largest cryptocurrency exchange, suffered a breach on Thursday that resulted in hackers stealing $6.3 billion in digital assets, making it the biggest crypto hack ever and surpassing the $1.5 billion Bybit theft in 2025 as well as earlier attacks on Poly Network, Ronin Network, Coincheck and MT Gox.
Co-CEO Richard Teng called the incident a highly complex attack. Early investigation linked the breach to a compromised engineer's laptop, but later findings revealed multiple intrusion points and sophisticated malware with a self-destruct feature that erased evidence. Binance also noted that more than one individual was involved.
The hack rattled the market: Bitcoin fell nearly 5%, Ethereum dropped almost 6%, and Binance's BNB token slid close to 10%.
FBI Points the Finger at North Korea
The FBI announced on Saturday that a North Korea-linked group, identified as TraderTraitor and believed to operate under the Lazarus Group, carried out the attack. The Lazarus Group previously hacked Sony Pictures in 2014 in retaliation for "The Interview". The agency also blamed North Korea for the 2025 Bybit hack.
The FBI is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor." The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages. How You Can Help: FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets. A list of addresses associated with this activity is available here: https://t.co/g0oIWx0WeD
— FBI Cyber Branch (@FBICyberBranch) October 31, 2026
Law enforcement says the actors are converting the stolen assets into Ethereum and likely will launder them further via decentralized finance and instant-swap services. The FBI urged private firms to block transactions linked to the identified addresses.
North Korea denied any involvement, and its missions in Geneva and China did not respond to comment requests. Observers note the heavily sanctioned country often uses illicit proceeds to fund its nuclear and missile programs, and experts warn that AI advances could further threaten cryptography and IT security.
How Binance is Protecting Its Users
Binance halted all user withdrawals right after the breach but said it remains committed to safeguarding customers. The exchange allocated $6.34 billion of its own funds to cover losses, already restoring $6 billion and replacing 90% of the stolen assets. The remaining 10% consists of less liquid tokens that will take longer to source, and Teng assured users they will not bear any financial burden.
To finance the recovery, Binance drew from its corporate treasury, its Futures Insurance Fund, and spent half of its $1 billion Secure Asset Fund for Users (SAFU). Co-CEO Yi He said the SAFU will be replenished back to roughly $1 billion.
Binance worked closely with the US Secret Service, intelligence firms and industry partners. The Secret Service helped trace and freeze about $3 billion of the compromised assets by Friday.
On Sunday, November 1, Binance planned a phased restart of withdrawals to maintain system stability. At 07:50 AM PKT withdrawals remained closed. The exchange performed a proof-of-reserves snapshot on October 31 at 5:00 AM PKT, allowing holders of ten specific tokens to verify a minimum 1:1 backing. The tokens are BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC.
All holdings of Bitcoin, Ethereum, Tether and seven other widely-traded assets are fully covered.
