Binance Says It Replaced $6.3 Billion After Record Crypto Heist
Binance committed resources to cover customer losses following a record crypto heist, though the original stolen assets remain missing.
Binance has restored customer balances after a record $6.3 billion theft, but the original stolen assets remain missing.
The world's largest cryptocurrency exchange said it committed more than $6.34 billion in company resources to cover customer losses following the October 29 attack, drawing on its Secure Asset Fund for Users and corporate treasury holdings. Replacement tokens were acquired through market purchases and over-the-counter transactions spread across roughly two weeks. The critical distinction is that Binance bought new tokens to make customers whole; the assets attackers took have not been recovered and remain in circulation.
Media additions
Blockchain intelligence firm TRM Labs documented the scale and speed of the theft, recording approximately $6.36 billion moved out of Binance wallets across ten separate blockchains, with most of the transfer completed in about 20 minutes. TRM Labs attributed the attack with high confidence to TraderTraitor, a state-linked hacking unit, based on blockchain transaction analysis, off-chain intelligence, and operational similarities to previous attacks tied to the same group. That is an intelligence assessment, not a confirmed legal finding.
The incident is roughly four times larger than the $1.5 billion Bybit theft in February 2025, which U.S. Authorities also attributed to TraderTraitor.
| Metric | Figure | Source |
|---|---|---|
| Estimated total impact | $6.3 billion | Binance |
| Assets moved out of Binance wallets | $6.36 billion | TRM Labs |
| Company funds committed to cover losses | $6.34 billion | Binance |
| Stolen assets frozen or intercepted | Nearly $3 billion | Binance |
| Stolen assets frozen or intercepted | Approximately $2.7 billion | TRM Labs |
| Cryptocurrency seized by U.S. Authorities | More than $1.2 billion | FBI |
| Duration of main transfer | About 20 minutes | TRM Labs |
| Blockchains affected | Ten | TRM Labs |
| Previous record crypto heist (Bybit, February 2025) | $1.5 billion | TRM Labs / U.S. Authorities |
Binance's preliminary investigation initially pointed to a compromised laptop belonging to a DevOps engineer as a suspected breach point. The company later indicated it had identified additional potential entry points, and the investigation remains active. Details on how privileges escalated from that device to exchange wallets across ten blockchains have not been publicly confirmed.
Binance co-CEO Richard Teng said on X that the attacker did not simply use one engineer's permissions, and this was not a single "one-click" action. "It involved a more complex attack process," Teng said. "Our investigation has not attributed responsibility to any individual. So far, we have found no evidence of any wallet private key leak."
Binance published an incident report describing a sophisticated, multi-stage campaign that began in June with a supply chain attack involving a malicious Homebrew installation. In September, another software engineer was contacted through a legitimate job-hunting platform by someone purporting to be a project director who arranged a series of job interviews with a fake company. During a live video interview, the interviewer shared social media content to build trust. In a second interview with someone purporting to be the CEO of the phony company, conducted on a popular social chat app, the engineer was instructed to download an assignment containing a malware-laced code repository.
The malware replaced a legitimate development tool component with a malicious version, established communication with an attacker-controlled external server, and evaded Binance's endpoint security tools. On October 20, the miscreants used the compromised computer and an internal AI tool to gain access to the computers of wallet DevOps engineer A and another wallet software developer. On October 29, the attacker accessed one engineer's computer, used stolen credentials to deploy a container, and triggered a script to launch the cryptocurrency-stealing attack.
Teng himself did not attribute the attack to North Korea but acknowledged that the FBI has linked it to North Korean hackers tied to the TraderTraitor group. The FBI attributed the theft to TraderTraitor, a North Korean hacking operation linked to Lazarus Group, known for combining espionage with massive cryptocurrency heists. The Pyongyang-backed crew is also highly adept at job market scams, both posing as IT workers hired by Western companies and as potential employers to lure software engineers into downloading malware.
Nearly $3 billion in stolen assets were frozen or intercepted shortly after the attack, though estimates from different sources vary. Binance said nearly $3 billion in stolen assets were frozen or intercepted; a later TRM Labs figure placed that amount at approximately $2.7 billion. The exchange said it is working with the FBI on recovery efforts.
The FBI said Thursday that it had seized more than $1.2 billion of cryptocurrency reported stolen last month from Binance. The U.S. Government and private sector have so far combined to freeze more than $2.7 billion of the stolen funds, and the Justice Department said Thursday that it has now obtained court authorization to seize or restrain more than $1.2 billion of that total. Typically in those situations, the U.S. Government will file a claim of forfeiture with a judge, who will then determine who has a legitimate claim to the recovered funds.
Also Thursday, the FBI blamed North Korea for a separate social engineering scheme that officials say resulted in the theft of $400 million worth of cryptocurrency over the last 18 months. That scheme, known as FaceStealer, involves a complicated chain of events combining the hijacking of popular messaging apps and the recording of deepfake videos. U.S. Officials have repeatedly accused North Korea of using cyber schemes to generate funds for its regime, including its illicit weapons program.
Attackers routed remaining funds through thousands of wallets and transactions to obscure their origin. Blockchain researchers also reported that the attackers reportedly created memecoins as part of an effort to launder approximately $430,000 in stolen cryptocurrency.
Binance said it has replenished 98 percent of $6.34 billion in affected assets, and that it is still in the process of purchasing outstanding, more illiquid assets. The exchange said it would restore withdrawals in phases while the verification and broader recovery process continues.
Until Binance's proof-of-reserves process is complete and independently confirmed, the fully-backed claim rests substantially on the exchange's own disclosure. Binance published a proof-of-reserves snapshot and said holdings are intended to back customer assets on a one-to-one basis. That complete proof has not yet been published or confirmed on-chain.
Binance and industry partners including Tether, Circle and Ripple have reportedly frozen about $3 billion in assets, though some stolen funds continue to move through laundered channels. Coinbase blocked transfers to compromised wallets and offered Binance direct assistance.
The hack sparked a sharp but short-lived hit to confidence across crypto markets, especially compared with previous failures at major exchanges. Investors are now watching whether Binance can fully restore confidence in centralized exchanges.
What to watch next
- Whether Binance's updated proof-of-reserves report is published and independently confirmed on-chain.
- How smoothly phased withdrawals reopen for customers holding less-liquid tokens.
- Whether U.S. Authorities move to forfeit the more than $1.2 billion in seized cryptocurrency.
- Whether independent cybersecurity reviewers validate Binance's account of the multi-stage breach.
