Binance Recovers 90 Percent of Assets After $6.3 Billion North Korea-Linked Hack

Binance stated on November 1, 2026, that it had recovered and replenished 90 percent of the assets taken in a $6.3 billion to $6.6 billion hack that occurred over roughly 20 minutes. The exchange attributed the intrusion to North Korean state-sponsored actors linked to the Lazarus Group and the Trader Traitor operation. The breach began through a compromised engineer’s laptop.

The company has not released a full technical timeline or the precise methods used to move the funds after the initial access. Recovery of the majority of the value within days indicates that a substantial portion of the stolen assets remained on chains or platforms where Binance could still exercise control or negotiate return. The remaining 10 percent has not been detailed.

North Korean cyber units have previously targeted exchanges and decentralized finance protocols for hard-currency revenue. The scale of the current incident exceeds most prior public reports of single-event thefts from centralized platforms. Binance’s ability to restore most customer balances quickly has limited visible market disruption so far, though the event has renewed questions about the security of employee devices and the speed of response once an intrusion is detected.

No customer names or specific wallet addresses have been published. The exchange continues to work with investigators. The incident occurred in the same week as separate cyberattacks on European supermarket refrigeration systems, but no connection between the two has been established. The partial recovery reduces the immediate loss but leaves the residual amount and the long-term attribution details for further disclosure.