Binance Covers Losses After $6.36 Billion Crypto Theft Linked to North Korea

Binance, the largest cryptocurrency exchange by volume, said it has reserved more than $6.34 billion of its own funds to cover a theft of roughly $6.36 billion that occurred on October 29, 2026. The company resumed phased withdrawals after a suspension that began the day of the attack.

TRM Labs attributed the theft to TraderTraitor, North Korea's elite hacking unit, with high confidence based on on-chain and off-chain data. Chainalysis reached the same conclusion after observing stolen Binance funds commingle with proceeds from a prior $388 million Bitget exploit also linked to North Korean actors. The FBI confirmed the attribution on October 31, stating that North Korea was responsible for the theft of more than $6 billion in virtual assets.

Most of the funds left Binance wallets across ten blockchains in about 20 minutes starting around 4:05 p.m. Eastern Time. On Ethereum the attackers used an EIP-7702 delegation to turn a hot wallet into a controlled sweeper with 50 pre-signed authorizations. A single transaction moved 167,464 ETH plus other tokens. Binance initially pointed to a compromised engineer laptop as the entry point, then said the investigation found additional breach points in its signing infrastructure.

Partners froze roughly $3 billion. Tether, Circle, Ripple, and World Liberty Financial locked about $2.67 billion in stablecoins. Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB. The attackers sold USDT and borrowed against remaining assets on Aave before freezes took full effect. Binance co-CEO Richard Teng stated the company would absorb the financial impact, not users.

The haul is about four times the $1.5 billion Bybit theft of February 2025, previously the largest crypto heist and also attributed to TraderTraitor. North Korean state-linked groups have conducted repeated exchange and protocol attacks for years, converting proceeds into revenue for weapons programs according to U.S. and South Korean assessments. President Trump said on October 31 that confirmation would prompt discussions with North Korea.

Binance set aside $5 billion already held in the exact tokens stolen and additional company reserves to reach the full cover amount. Withdrawals restarted in stages beginning November 1 to maintain platform stability. Deposits were never interrupted. The incident triggered a short-term drop in Bitcoin ETF flows of about $203 million the following day, according to industry trackers.

Blockchain analysts continue to monitor remaining attacker-controlled addresses holding more than 420,000 ETH and 18,270 BTC. Freezes reduced the liquid portion but did not recover all assets. Binance has not disclosed the full technical sequence beyond the laptop and signing-system compromise. The FBI listed specific Ethereum, Bitcoin, and Solana addresses linked to the group and asked for transaction blocks and tips.

The theft ranks as the largest known cryptocurrency heist by value at the time of the transfers. It demonstrates both the scale of state-sponsored cyber operations against centralized exchanges and the speed with which issuers and networks can freeze stablecoins and governance tokens once addresses are identified. Binance's decision to make users whole from its own balance sheet avoids immediate customer losses while the investigation proceeds.