Binance covers 95% of $6.3bn crypto heist losses as FBI blames North Korea

New Delhi: Binance says it has replenished about 95% of the assets stolen in a $6.3 billion cryptocurrency heist and announced a phased restoration of withdrawals on November 1, 2026. The recovery update came after the US Federal Bureau of Investigation (FBI) attributed the attack to North Korea, turning the world’s largest reported cryptocurrency theft into a major investigation into state-sponsored cybercrime.

The latest figure improves on the 90% replenishment announced a day earlier, although replacing assets does not mean Binance has recovered the same proportion of the stolen money from the attackers. The exchange is using its own resources to rebuild its holdings while investigators separately trace the funds and attempt to prevent their laundering.

The theft occurred on October 29, prompting Binance to suspend withdrawals and investigate how attackers penetrated its systems. Blockchain intelligence firm TRM Labs estimates that approximately $6.36 billion was taken, with most of the money moved in about 20 minutes – roughly four times the value of the $1.5 billion Bybit hack in February 2025.

In its recovery announcement, Binance scheduled the first stage of withdrawal restoration between 11.30am and 2.30pm Indian Standard Time. The initial rollout covers selected assets and networks, including bitcoin, ether, BNB, Solana, XRP and dogecoin, with further services to follow after checks.

The announcement sets out a phased reopening rather than confirming that every withdrawal service is available. Binance warned of possible processing delays during the rollout and said customers should check availability for their chosen asset and network; deposit services remained open in its latest update.

The outstanding 5% consists of less-liquid tokens that are harder to acquire in large quantities, according to the exchange. Binance said it was continuing purchases through market and over-the-counter transactions and maintained that customers would not bear the financial losses.

FBI identifies North Korean operation

In an alert issued on October 31, the FBI said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance. It identified the malicious activity as “TraderTraitor”, moving beyond the earlier assessments by private blockchain investigators that Pyongyang-linked hackers were the likely perpetrators.

The bureau said it was working with the US Secret Service and the Internal Revenue Service’s criminal investigation division, and had observed the attackers converting stolen assets primarily into ether. Investigators expected further laundering through decentralized finance platforms and instant-swap services, which allow assets to be exchanged and moved through additional transactions.

The FBI published cryptocurrency addresses associated with the theft and urged exchanges, infrastructure operators and other service providers to block transactions involving them or funds derived from them. The effort seeks to restrict the attackers’ ability to move and cash out the proceeds.

North Korea has long denied using state-linked cyber units for espionage, financial theft or revenue generation. Its diplomatic mission in Geneva and embassy in China did not respond to Reuters’ requests for comment on the Binance attack.

Investigation extends beyond an employee’s laptop

Binance’s initial investigation pointed to a potentially compromised employee laptop, but its subsequent findings identified additional breach points. In its October 30 security update, the company described a complex attack and said it had found no evidence that wallet private keys had been leaked.

As RNA Media reported earlier, the suspected entry point involved a development and operations engineer’s laptop. The preliminary account suggested that access gained through the device enabled unauthorized withdrawal requests, although the wider investigation means that explanation remains incomplete.

TRM Labs’ technical assessment found that the attackers used an Ethereum authorization mechanism to turn a Binance hot wallet into a tool for transferring funds under their control. It also identified transfers across other blockchains and assessed that Binance’s infrastructure for signing hot-wallet transactions had been compromised.

Hot wallets are connected to online systems to facilitate transactions, making their authorization controls critical to security. The findings suggest that understanding the breach requires examining the systems that approved transfers, alongside investigating whether any secret credentials were exposed.

Binance’s co-chief executive, Richard Teng, described a review spanning employee devices, cloud infrastructure, key management and transaction-signing systems. Binance has promised a fuller account after completing its investigation, leaving the precise sequence of failures subject to further verification.

Replacing losses and recovering stolen funds

Binance said on October 30 that it had set aside more than $6.34 billion in company funds, including about $5 billion already held in the same tokens affected by the theft. It also reported that approximately $3 billion in stolen assets had been frozen through cooperation with law enforcement, blockchain investigators, token issuers and other industry partners.

Frozen assets and replenished holdings represent different parts of the response: freezing restricts the movement of suspected stolen funds, while replenishment replaces assets missing from the exchange. Binance’s announcement that it had frozen funds therefore did not establish that those assets had already been returned to its control.

In its funding disclosure, Binance said replacement purchases drew on corporate funds, part of its Secure Asset Fund for Users and a portion of its futures insurance fund. The company maintained that the remaining futures insurance balance exceeded the level required by its risk-management framework.

That disclosure also said ten major assets, including bitcoin, ether, USDT, BNB and USDC, were fully backed, and announced a new proof-of-reserves snapshot. Binance said the complete cryptographic proof needed for users to independently verify their inclusion was expected on Tuesday, distinguishing the published reserve figures from the subsequent verification process.

The exchange’s immediate challenge is to restore reliable access while completing the replacement of affected tokens. The separate investigation must establish how the attackers defeated its controls and how much of the stolen money can ultimately be recovered.