• Analysis
Binance hack: exchange says 90% of $6.3bn stolen funds replaced as FBI points to North Korea
Binance says it has replaced 90% of the funds stolen in a $6.3bn hack of its platform, while the FBI identified a North Korea-affiliated group, TraderTraitor, as behind the attack.
Most stolen funds replaced
Ninety percent of the tokens taken in the record $6.3bn Binance hack have been bought back, according to the cryptocurrency exchange. In a post on X on Saturday, Binance said the remaining 10% are less liquid tokens, so the re-buying may take longer.
To cover the losses, the company said it had set aside around $6.34bn of company funds and that Binance will fully cover the financial impact of the stolen funds.
- •Part of the re-buying used the $1bn Secure Asset Fund for Users, a bitcoin reserve
- •Some of its Futures Insurance Fund was also drawn on
- •The rest came from the corporate treasury
Co-CEO Richard Teng said separately that the company was committed to covering the remaining 10%.
Users will not bear the financial impact of this incident
That was Teng's assurance on the $6.3bn hack.
FBI names TraderTraitor
On Saturday the FBI confirmed earlier suspicions from private investigators and analysts that a North Korea-affiliated group called TraderTraitor was behind the hack. TraderTraitor is believed to be part of the Lazarus Group.
The bureau attributed the theft of more than $6 billion USD in virtual assets from Binance on or about October 29, 2026 to North Korea. It said it had watched TraderTraitor actors swap the stolen assets into Ethereum, and expects the funds to keep moving through decentralised finance services and instant swap platforms. Companies in the private sector were told to cut off any transactions touching the wallet addresses the actors rely on for laundering.
How the breach happened
Teng said on Friday the breach was a complex attack involving a compromised laptop, along with malicious software designed to delete evidence of its activity.
Market reaction and withdrawals
The cryptocurrency theft moved prices sharply: Bitcoin plunged nearly 5% after the news of the hack, Ethereum dropped nearly 6% and BNB tumbled nearly 10%.
User withdrawals were suspended after the hack. Binance said on Sunday that some had resumed and would be rolled out in phases to ensure stability.
