Binance to restart withdrawals after funding 90% of $6.3 billion hack losses
The exchange says it has replaced most stolen tokens and expects to resume user access on Sunday, following an FBI confirmation that a North Korean group executed the breach.
By Jacob Reynolds ·
Binance has replaced 90% of the $6.3 billion in cryptocurrency stolen from its platform in a record-setting hack. The exchange announced on Saturday that it is on track to resume user withdrawals on Sunday. This move follows the FBI's confirmation that a North Korea-affiliated group was responsible for the theft.
The breach occurred on or about October 29, 2026. Co-CEO Richard Teng described the incident as a complex attack involving a compromised laptop and malicious software. He said the software was designed to delete evidence, making the investigation more difficult. The company stated that users will not bear the financial impact of the incident.
The FBI identified the perpetrators as TraderTraitor, a group believed to be part of the Lazarus Group. The agency said it observed these actors converting stolen assets into Ethereum. The FBI added that it expected the assets to be further laundered through decentralized finance and instant swap services. It urged private sector entities to block transactions derived from the addresses used by the attackers.
Binance set aside approximately $6.34 billion in company funds to cover the losses. The company used part of its $1 billion Secure Asset Fund for Users, which serves as a bitcoin reserve for customer protection. It also drew from its Futures Insurance Fund and its own corporate treasury to re-buy the tokens. The remaining 10% of tokens are less liquid, which may extend the time needed to complete the replacement.
Market reactions to the hack were sharp. Bitcoin prices fell nearly 5% after the news broke. Ethereum dropped nearly 6%, and BNB, the token native to Binance, tumbled nearly 10%. The scale of the theft has drawn attention to the financial capabilities of North Korea, a country facing extensive international sanctions over its nuclear and missile programs.
The Lazarus Group first gained notoriety in 2014 when it was accused of hacking Sony Pictures. That earlier attack was reportedly revenge for the film The Interview, which mocked North Korean leader Kim Jong-un. The current incident coincides with growing concerns that expanding artificial intelligence capabilities could compromise cryptography and IT security protocols.
Source: The Guardian
