- Binance suffered a $6.3 billion hot wallet compromise on October 29, marking the largest cryptocurrency theft on record.
- The FBI attributed the attack to North Korea’s TraderTraitor group, part of the Lazarus Group.
- The exchange has replenished 90% of the stolen assets with company funds and targets withdrawal resumption on November 1.
- Partners including Tether and Circle froze roughly $3 billion in stolen stablecoins and other assets.
Binance has replenished 90% of the cryptocurrency stolen in a record $6.3 billion hot-wallet hack that occurred on or about October 29, according to an update from the exchange reported by CoinDesk. The company said major tokens including bitcoin, ether, USDT, BNB, SOL and USDC are now fully backed, with the remaining 10% consisting of less liquid assets that it continues to acquire through markets and over-the-counter trades.
The FBI confirmed on October 31 that North Korea’s TraderTraitor hacking group, a subunit of the Lazarus Group, was responsible for the theft. The bureau stated that attackers have been converting stolen assets primarily into ether and urged virtual asset service providers, DeFi platforms and node operators to block related addresses. Blockchain analytics firms including TRM Labs and Chainalysis had earlier attributed the attack to the same group with high confidence, noting similarities to prior North Korean operations such as the 2025 Bybit exploit.
Binance co-CEO Richard Teng said in a video update on X that the attack was complex, involving a self-destruct mechanism that erased evidence and the use of Ethereum’s EIP-7702 account-delegation feature to gain execution approval over a hot wallet without passing through normal controls. An initial investigation pointed to a compromised DevOps engineer’s laptop, with additional breach points subsequently identified. Teng emphasized that customer funds were never touched and that Binance will cover all losses from its own resources, including the Secure Asset Fund for Users and corporate treasury.
The exchange set aside more than $6.34 billion in company funds, of which $5 billion was already held in the exact tokens affected, according to its October 30 security incident update. Separately, industry partners froze approximately $3 billion in stolen assets, including large amounts of USDT and USDC. Binance has published a proof-of-reserves snapshot showing coverage ratios of 100% or higher for key tokens as of midnight UTC on October 31 and plans a full report by Monday.
The incident triggered market volatility, with leveraged liquidations exceeding $1.5 billion and pressure on bitcoin and ether prices, though analysts noted that the scale of the freezes and Binance’s commitment to full reimbursement limited the longer-term damage relative to earlier exchange hacks. Withdrawals, paused since the breach, remain on track to resume on Sunday, November 1, as the investigation continues alongside U.S. law enforcement.
