Binance says 90% of $6.3 billion is replaced as FBI names North Korea

Binance says it has replaced 90% of the assets stolen in a hack it estimates cost $6.3 billion, while the FBI has attributed the theft to North Korea. ^[1][2]

The cryptocurrency exchange said it remained on track to resume withdrawals on Sunday, November 1, with another update to follow once details were confirmed. It said the remaining 10% consisted of less easily traded tokens that would take longer to buy in the amounts needed. ^[1][3]

Binance said it had set aside about $6.34 billion of company money to cover the financial impact and that customers would not bear the loss. Its replenishment draws on its Secure Asset Fund for Users, its Futures Insurance Fund and its corporate treasury. ^[1][3]

The FBI's October 31 announcement puts a state-backed attacker at the centre of the investigation. The bureau called the activity TraderTraitor. ^[2]

The Daily Inference reported on October 30 that Binance's initial estimate would make this the largest known cryptocurrency theft, and that the exchange had halted withdrawals and promised to cover losses.

Withdrawals have not been confirmed as reopened. There is also no independent audit of the replenishment claim or complete public technical account of the breach, and the FBI has not published the detailed evidence underlying its attribution. ^[1][2][3]

Replacing assets is different from recovering them

Binance's financial response has two separate parts: buying assets to fill the hole in its holdings, and helping investigators pursue the assets taken by the attackers. Success at the first does not establish success at the second.

The company said its holdings of bitcoin, ether and Tether, a stablecoin pegged to the dollar, along with seven other widely traded crypto assets, were covered. It was still acquiring the other affected assets through markets and over-the-counter transactions, purchases negotiated directly rather than placed through an exchange's public trading system. ^[3]

The final 10% illustrates a practical problem with a theft involving different tokens. Money committed to replacing them does not instantly produce the required coins. Binance said those remaining assets were less liquid, meaning there were fewer readily available to buy in the quantities it needed. ^[1][3]

For customers, the immediate test is whether the exchange can honour withdrawal requests in the assets they hold. A dollar amount set aside for compensation and an operational withdrawal service answer different questions.

Separately, the BBC reported that Binance had frozen around $3 billion of stolen assets by October 30, working with law enforcement, intelligence firms and other partners. That figure describes assets reportedly blocked from moving, rather than tokens bought to replenish customer holdings. ^[3]

It cannot simply be added to the replacement percentage as though both measured money returned. Freezing an asset can obstruct an attacker without putting it back into an exchange's possession. The replacement effort can restore holdings while the pursuit of the stolen funds continues.

The FBI follows the money

The FBI said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or about October 29, 2026. Its notice identifies cryptocurrency addresses that it says hold, or previously held, proceeds of the theft and are operated by or closely connected to North Korean TraderTraitor actors. ^[2]

Working with the US Secret Service and IRS Criminal Investigation, the bureau said it had observed conversions primarily into Ethereum. It expected further laundering through decentralised finance and instant-swap services, which allow assets to be exchanged through routes beyond conventional centralised exchanges. ^[2]

The request to businesses is practical: identify the listed addresses and block associated transactions. That makes the pursuit of the money a task extending beyond Binance to other firms that might handle it. ^[2]

The Secret Service said on October 30 that it was working with private-sector partners to identify, freeze, trace and recover the stolen funds. It described its investigation as being in its early stages. ^[4]

The FBI previously attributed the February 2025 theft of about $1.5 billion from the cryptocurrency exchange Bybit to North Korea. North Korea has denied involvement in such attacks, according to the BBC. ^[3]

Binance said it was working with law-enforcement partners to confirm the attackers' identities. The FBI's formal attribution now supplies the US government's answer to that question while investigators continue pursuing the assets. ^[1][2]

Reserves and withdrawal security face separate tests

Binance co-CEO Richard Teng said the breach involved a compromised laptop and malicious software designed to erase evidence. The company also said its subsequent investigation found additional points of breach. ^[1][3][4]

That account puts the security of systems used to authorise withdrawals alongside the size of the company's reserves. An exchange can have funds available to absorb a loss and still need to establish how an attacker made its systems release assets.

Every exchange holding customers' money faces those two tests. Financial capacity determines whether it can replace what disappears. Security controls determine whether an intruder can cause the disappearance in the first place. Binance's ability to buy replacement tokens addresses the financial damage, while the compromised laptop and additional entry points demand a technical explanation.