Binance says it has now replaced about 95% of the cryptocurrency stolen in a roughly $6.3 billion hack of its hot wallets, the largest crypto theft on record, as customers pulled billions of dollars from the exchange after withdrawals reopened on November 1, 2026.
The FBI has attributed the attack to North Korea. Binance, the world's largest crypto exchange, has said it will cover the losses with company money rather than pass them on to users.
What Happened in the Binance Hack
The theft began at 20:05 UTC on October 29, 2026, according to blockchain analytics firm TRM Labs. TRM estimates that about $6.36 billion, valued at the prices at the time of the transfers, was moved out of Binance wallets across ten blockchains, most of it within roughly 20 minutes. That is about four times the $1.5 billion stolen from the Bybit exchange in February 2025.
How the attackers got in is still being investigated. Binance first said the breach may have started with a compromised DevOps engineer's laptop. Co-chief executive Richard Teng later said the company had found additional breach points and that the attackers used Ethereum's EIP-7702 account delegation feature to take control of a hot wallet without going through Binance's normal approval process, CoinDesk reported. "This was a complex attack," Teng said.
TRM says the attacker prepared 50 pre-signed authorizations in advance, which it believes points to a compromise of Binance's hot wallet signing infrastructure. A hot wallet is an internet-connected wallet an exchange uses to process day-to-day deposits and withdrawals.
FBI Blames North Korea's TraderTraitor
On October 31, the FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance, activity it tracks as "TraderTraitor." The bureau said the stolen funds were being converted primarily into Ether and that it expects further laundering through decentralized finance and instant swap services. It asked exchanges, node operators and analytics firms to block transactions linked to the addresses involved.
TRM Labs had separately attributed the attack to TraderTraitor "with high confidence," the same group the FBI blamed for the Bybit theft. TRM says the attacker sold about 325 million USDT to market makers for roughly 122,300 ETH at a discount of more than 10%, borrowed against stablecoins on lending protocols and began splitting stolen Bitcoin across many transactions.
How Binance Is Covering the Losses
On October 31, Binance said it had restored backing for up to 90% of the stolen assets, CNBC reported. That does not mean 90% of the funds were recovered from the attacker. Binance bought replacement tokens, funded by partly drawing on its Secure Asset Fund for Users (SAFU), part of its futures insurance fund and its corporate treasury.
The exchange said its largest assets, including BTC, ETH, USDT, BNB, SOL, USDC and XRP, were "fully backed 100%." In a statement, Binance said it "will absorb the financial impact of these stolen funds, not our users."
By November 2, Binance said coverage had reached about 95%, according to CNBC. The remaining 5% consists of less liquid tokens that take longer to buy in the quantities needed, and the company says it will keep purchasing them through markets and over-the-counter deals until coverage reaches 100%.
Billions Frozen, Billions Still Out of Reach
Stablecoin issuers and other parties have frozen part of the stolen funds. As of TRM's analysis, about $2.7 billion had been frozen, led by roughly 1.77 billion USDT frozen by Tether and about 825 million USDC frozen by Circle, with smaller amounts frozen by Ripple, World Liberty Financial and Arbitrum's Security Council. Circle has since said it froze more than $1.1 billion in USDC linked to the incident.
TRM estimated that the attacker still held about $2.4 billion in assets beyond the reach of any issuer. Frozen totals are still changing as the investigation continues.
$3.6 Billion Leaves Binance as Withdrawals Reopen
Binance paused withdrawals after the attack and reopened them in phases from 06:00 UTC on November 1, starting with the Bitcoin network. By 12:36 UTC, it said withdrawals were restored across all 15 networks and assets in the first phase.
Between 06:00 and 15:30 UTC that day, customers withdrew $4.65 billion and deposited $1.01 billion, a net outflow of $3.64 billion, Binance said. That equals about 2.1% of the $171 billion in total assets shown in its most recent proof-of-reserves data, dated October 28. Binance founder Changpeng Zhao wrote on X that "98% choose to stay!"
Questions That Remain
- Root cause: Binance has not yet published a full account of how the attackers breached its systems. It said it is reviewing cloud systems, employee devices, private key management and transaction signing.
- Whose funds were hit: Teng said the attack targeted Binance's own hot wallet rather than customer funds, but a CoinDesk review of Binance's reserve data found the compromised wallets had previously been listed among assets backing customer balances.
- Recovery: How much of the roughly $2.4 billion still controlled by the attacker can be traced and frozen will depend on how quickly it moves through bridges, swap services and brokers.
For businesses, the attack is another reminder of why insurers now demand proof of strong access controls before writing cyber cover, as explained in our board checklist on cyber insurance.
This article is for information only and is not investment advice. Figures are as reported by the sources cited as of November 2, 2026, and may change.