Binance says it will cover all of the roughly $6.3 billion stolen in the record hack the FBI blames on North Korea. Here’s what happened, where withdrawals stand and how to protect your account.
Binance says it will cover all of the roughly $6.3 billion stolen in the record hack the FBI blames on North Korea. Here’s what happened, where withdrawals stand and how to protect your account.
Kara
Yes, for now, Binance says customer balances are safe. The exchange says it will cover every dollar of the roughly $6.3 billion taken in the late-October hack, the largest crypto theft on record, and it has fully restored backing for its 10 biggest coins, including Bitcoin, Ether and USDT. Withdrawals began reopening on Nov. 1, but not every network is back yet. Here’s what happened, who the FBI says did it, and what you should do if you have money on the exchange.
On or about Oct. 29, 2026, attackers made unauthorized withdrawals from Binance’s hot wallets, the online wallets an exchange uses to process everyday withdrawals. In its Oct. 30 security update, Binance said its initial investigation pointed to “a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.” It said it found no evidence that any wallet private keys had leaked.
The story has grown more complicated since. Co-CEO Richard Teng later said investigators found additional points of breach. “This was a complex attack. The attacker also used a self-destruct mechanism that destroyed tooling and traces as they went, making it more difficult for us to trace and investigate,” he said, according to The Record. Binance has promised a full technical post-mortem once the investigation is complete.
Binance puts the total impact at about $6.3 billion. Working with blockchain partners, it said roughly $3 billion of the affected assets had been frozen on-chain, which means the coins are blocked from moving even though they haven’t been returned yet. Frozen is not the same as recovered, and the remaining funds are being laundered quickly, as explained below.
The FBI said on Oct. 31 that North Korea was responsible. In an official alert, the bureau named the activity “TraderTraitor,” the same state-backed group (often called the Lazarus Group) blamed for the roughly $1.5 billion Bybit hack in 2025. The FBI, the Secret Service and IRS Criminal Investigation said the hackers were converting stolen assets mainly into Ether and asked exchanges, DeFi services and node operators to block transactions tied to a published list of wallet addresses.
North Korea denies it. Kim Yo-jong, sister of leader Kim Jong Un, called the accusation “a trite provocation,” the BBC reported on Nov. 3.
Blockchain analysts say the laundering is moving at machine speed. Elliptic told The Record the hackers had used about 12,000 wallets across 11 blockchains, making around 40,000 transactions and moving funds to a new wallet roughly every 25 seconds. Chainalysis said North Korea accounts for almost 90% of crypto hack losses in 2026.
Binance’s position is clear: “Binance will absorb the financial impact of these stolen funds, not our users,” it said in a statement reported by CNBC. Here’s where things stand based on the company’s own updates:
A company promise is not the same as a government guarantee. Crypto held on an exchange isn’t covered by FDIC or SIPC insurance the way a bank deposit or brokerage account is, so your protection depends on Binance actually following through. So far its public updates have tracked with what it said it would do.
Partly. Binance began a phased restoration at 06:00 UTC on Nov. 1, starting with the Bitcoin network and then adding Ethereum and BNB Smart Chain. By 12:36 UTC that day, withdrawals were open on all 15 networks and assets in the first phase, ET Now reported. Remaining networks are still being tested, and Binance hasn’t given a date for full restoration. Deposits kept working throughout.
Plenty of customers moved money out once they could. Between 06:00 and 15:30 UTC on Nov. 1, Binance processed $4.649 billion in withdrawals and $1.01 billion in deposits, for a net outflow of about $3.64 billion. Binance said that was 2.1% of its $171 billion in assets under management, based on its Oct. 28 proof-of-reserves data, and that withdrawals spiked at first and then stabilized.
Whether you keep your coins on Binance or move them is your call, and this isn’t investment advice. But a few security steps make sense for anyone with a crypto account right now.
Teng has told users to check their funds in their accounts, and experts quoted by the BBC say to do it through the official Binance app or website only. Type the address yourself or use a bookmark you already trust.
Big breaches bring a wave of phishing. NordVPN CTO Marijus Briedis told the BBC to watch for “an email claiming your funds are at risk,” “a fake support account offering help” or “a message urging you to move your cryptocurrency to a ‘safe’ wallet.” Binance will never need your password or recovery phrase to fix this.
“Never give anyone your password, verification codes or wallet recovery phrase,” Briedis said. If someone asks for them, it’s a scam, no matter how official the message looks.
Use an authenticator app or passkey instead of SMS codes, turn on an anti-phishing code if your exchange offers one, and set up a withdrawal address allowlist so funds can only go to wallets you’ve approved. Our guide to protecting yourself from email threats covers the phishing basics in more depth.
This hack is a reminder that any online money service can go dark without warning. The same advice we gave after the Google Cloud outage that hit Revolut, Lloyds and HSBC applies here: don’t keep every dollar you might urgently need in one place.
If you get a scam message or lose money, report it to the FBI’s Internet Crime Complaint Center at ic3.gov and contact Binance support through the official app.
The hack raises hard questions for the industry. Jennifer Craven, a fraud expert at the law firm Pinsent Masons, told the BBC that “if a platform as sophisticated as Binance can suffer a serious attack, regulators will inevitably ask what that means for smaller, less mature platforms and currencies.” The attack also comes a month after Bitget said North Korean hackers stole more than $387 million, according to The Record. If you’re new to how digital assets work, our explainer on BTC Ordinals and the digital asset world is a good primer.
Binance estimates the total impact at about $6.3 billion, making it the largest crypto hack on record. Around $3 billion has been frozen on-chain.
Binance says no. It says it is covering all losses from its SAFU fund, insurance fund and company money, and that user funds are safe.
The FBI says North Korea’s TraderTraitor group, also known as the Lazarus Group, carried out the attack. North Korea denies involvement.
No. Binance.US said it was not affected. The breach hit the global exchange, Binance.com.
Withdrawals reopened in phases starting Nov. 1, beginning with Bitcoin, Ethereum and BNB Smart Chain. Some networks are still being tested, and Binance hasn’t said when all of them will return.
Featured image: Binance t-shirt and bag, by Bretwa, licensed under CC BY-SA 4.0, via Wikimedia Commons. Cropped and resized.
Five minutes, every Sunday. Free.
Clear, useful guides on money, health, tech, home and everyday life, one small step at a time.
© 2026 StepByStore. All rights reserved.
Disclosure: some articles include sponsored or guest contributions. Commercial links in those articles are marked as sponsored. Learn more in our Editorial Policy.
