Binance reopens withdrawals after record $6.3 billion hack as FBI blames North Korea

Richard Teng, now Binance co-CEO, speaking at Binance Blockchain Week in Istanbul in 2023. Photo: Binance, CC BY 4.0, via Wikimedia Commons.

Binance reopened withdrawals on Sunday, three days after hackers drained about $6.3 billion in crypto from the exchange’s hot wallets in what is now the largest theft in the industry’s history. Customers moved quickly. Between 6 a.m. and 3:30 p.m. UTC, Binance processed $4.6 billion in withdrawals against $1 billion in deposits, a net outflow of $3.6 billion, according to figures the company shared and TechCrunch reported.

That sounds like a run, and in raw dollars it is a big one. Binance put it at 2.1% of its total assets under management, which says more about the size of the world’s largest crypto exchange than about the calm of its users.

What was taken

Binance disclosed the breach on Thursday, Oct. 29. About $6.36 billion in tokens left its hot wallets, the internet-connected wallets exchanges use for day-to-day withdrawals, in less than 30 minutes. Blockchain analytics firm TRM Labs said the attackers pulled funds across ten networks, including Bitcoin, Ethereum, XRP, Tron, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon.

For scale, the previous record was the roughly $1.5 billion taken from the Dubai-based exchange Bybit in February 2025. This one is about four times larger.

Binance froze deposits and withdrawals while it worked to contain the damage. The company initially said the attack might have started with a compromised laptop belonging to a DevOps engineer, which gave the attacker access to a service container where unauthorized withdrawal transactions could be submitted. Co-CEO Richard Teng later pushed back on the idea that it was that simple. In a LinkedIn post, he wrote that “the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process.”

Binance has said it will publish a fuller incident report once its investigation is complete.

North Korea, again

TRM Labs pointed at North Korea early, and on Saturday the FBI agreed. The bureau attributed the theft to the North Korean group known as TraderTraitor, a unit often associated with the broader Lazarus Group, and said the stolen assets were being converted primarily into Ether ahead of further laundering, CNBC reported. The U.S. Secret Service has also said it is helping track the funds.

TRM said the attack shared hallmarks with earlier North Korea-linked heists, including the Bybit theft and the KelpDAO hack in April 2026. The firm cited “small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst.”

That last detail is the uncomfortable one for the industry. Exchanges have spent years layering approval controls, multi-signature schemes and withdrawal limits onto their wallets. An attacker who can collect valid signatures ahead of time and fire them all at once gets around many of those protections without ever touching a private key directly. North Korean groups have been refining that kind of patient, staged attack for years, and crypto theft is believed to be a major source of revenue for the country’s weapons programs.

Who pays

Binance says its customers won’t. “Binance will absorb the financial impact of these stolen funds, not our users,” the company said in a statement Saturday.

To back that up, it is drawing on three pools of money: its Secure Asset Fund for Users, known as SAFU, which it set up in 2018 for exactly this kind of event; part of its futures insurance fund; and its own corporate treasury. By Saturday it said it had restored backing for about 90% of the affected assets. On Sunday the figure was 95%. All bitcoin, ether, USDT, BNB, Solana, USDC, XRP and a handful of other major tokens are fully backed, Binance said. The rest are smaller, less liquid tokens it is still buying on the open market and through over-the-counter desks.

It’s worth being precise about what that means. Binance has not recovered the stolen crypto. It has replaced it with its own money. Funds stolen by North Korean groups have historically been very hard to claw back, though exchanges and stablecoin issuers sometimes freeze portions as they move.

What users should watch

Withdrawals are coming back in phases, by network and asset. Bitcoin, Ethereum and BNB Smart Chain were first. On Sunday morning the exchange’s status page still showed some networks partially or fully suspended, and the company warned of delays and longer processing times because of heavy traffic.

For customers, the practical advice hasn’t changed much. Keep an eye on the status page before moving funds, expect slow processing for the next several days, and be wary of phishing messages that pretend to be Binance support. Large, well-publicized incidents tend to bring a wave of scams right behind them.

The bigger question is regulatory. A $6.3 billion loss at a single exchange, even one covered in full, will be hard for lawmakers in Washington and abroad to ignore as they write rules for how crypto platforms secure customer assets.