Binance says 90% of losses from $6.3bn hack covered as FBI says North Korea behind attack

More than $6.3 billion in virtual assets were stolen from Binance on or about October 29, 2026, according to the FBI. Binance said it had set aside about $6.34 billion to cover the losses. The figure shows why the incident matters: it is enormous even for a major exchange and has tested Binance’s ability to protect customers.

Binance said it had replaced 90% of the stolen amount by buying tokens in the market. The company used part of its $1 billion Secure Asset Fund for Users, some Futures Insurance Fund money, and its corporate treasury. The remaining 10% involves less-liquid tokens, which can be harder to purchase quickly.

Co-CEO Richard Teng said Binance was committed to covering that final 10%. The company said users would not bear the financial impact. Withdrawals were suspended after the attack, but Binance said it expected to resume them on Sunday.

A cryptocurrency exchange is an online platform that lets users trade digital tokens and move them into or out of their accounts. Binance operates such a platform. It holds or controls assets needed to process withdrawals, so a serious breach can threaten both the exchange’s systems and customer balances.

The article says Binance suspended withdrawals after the hack. That pause likely prevented more funds from leaving while the company investigated a compromised laptop, malicious software, and the stolen assets. It also gave Binance time to check its systems and rebuild its token holdings. These operational reasons are grounded in the company’s response, while the broader explanation reflects how exchanges handle security incidents.

Binance said it was on track to resume withdrawals on Sunday. It also said users would not bear the financial impact, because the company planned to cover the stolen funds. The incident shows why access to an exchange can briefly be interrupted even when customers are promised reimbursement.

The FBI confirmed that North Korea was responsible for stealing more than $6 billion in virtual assets from Binance. It named TraderTraitor, a North Korea-affiliated group, as the actors behind the theft. This mattered because earlier suspicions had come from private investigators and analysts, while the FBI’s statement gave the attribution official law-enforcement backing.

The agency also described what it observed after the breach. TraderTraitor actors converted stolen assets into Ethereum and were expected to move them through decentralised finance and instant swap services. Those observed transactions helped identify how the stolen funds were being handled, although the article does not describe every part of the FBI’s investigative method.

TraderTraitor is believed to be part of the Lazarus Group. That group became notorious after being accused of hacking Sony Pictures in 2014 over The Interview. The FBI urged private companies to block transactions connected with addresses used to launder the stolen assets.

For customers, the immediate consequence was restricted access: Binance suspended withdrawals after the breach. The company said it would replace the stolen funds and that users would not bear the financial impact. It also said withdrawals were on track to resume Sunday. Those measures can limit direct customer losses, though they temporarily disrupt access to accounts and assets.

Prices reacted quickly. Bitcoin plunged nearly 5%, Ethereum dropped nearly 6%, and Binance’s BNB token fell nearly 10%. The article connects those declines with news of the hack. Such movements show how a major security incident can spread beyond the affected platform, especially when traders fear further selling or broader risks.

Confidence is harder to restore than tokens. Binance’s funding commitments may reassure customers, but the breach exposed weaknesses involving a compromised laptop and malicious software. The article says the attack also intensified worries about artificial intelligence threatening cryptography and IT security protocols.

Liquidity describes how easily an asset can be bought or sold without causing a large price change. Highly liquid tokens have many active buyers and sellers. Less-liquid tokens have thinner markets, so finding enough tokens can take longer and may require accepting less favorable prices. The article applies this distinction to Binance’s recovery.

Binance said it had replaced 90% of the stolen amount, but the remaining 10% consisted of tokens that were less liquid. The company therefore could not simply purchase all missing units immediately. Buying a large amount in a thin market can also push prices upward, making replacement more expensive or slower. The article does not provide individual token names.

The practical result was a delayed final step, not a decision to abandon the remaining loss. Co-CEO Richard Teng said Binance was committed to covering it. The company’s promise meant customers would not carry the financial impact while Binance continued sourcing the harder-to-buy tokens.

Laundering cryptocurrency means trying to disguise where stolen funds came from. The FBI said TraderTraitor actors converted the stolen assets into Ethereum. It expected them to launder the funds further through decentralised finance, known as DeFi, and instant swap services. The aim of such movement is to complicate tracing and recovery.

An instant swap service can exchange one token for another quickly, while DeFi uses blockchain-based services rather than a traditional central operator. Moving funds through several assets or services can create a more complicated chain of transactions. The article specifically says the assets were converted into Ethereum and were expected to be converted further using DeFi and instant swaps; it does not identify particular services.

The FBI urged private-sector entities to block transactions involving addresses used by TraderTraitor or derived from them. That response targets the public blockchain trail. It also shows the challenge: stolen tokens can move quickly, while companies must identify suspicious addresses and avoid processing connected funds.

Cryptography is the use of mathematical methods to protect information, control access, and verify digital activity. Cybersecurity protocols are the rules and procedures systems use to authenticate users, secure communications, monitor threats, and respond to breaches. The article raises concern that expanding artificial-intelligence capabilities could compromise cryptography and IT security protocols.

The Binance attack shows a different but connected weakness. Richard Teng said it involved a compromised laptop and malicious software designed to delete evidence of its activity. If an attacker controls a trusted device, they may obtain credentials, interfere with software, or send authorized-looking instructions. Deleting evidence can also make investigation and tracing harder. These are general cybersecurity mechanisms, not details the article attributes directly to every stolen transaction.

Strong cryptography cannot fully protect a system when attackers compromise the devices or people that use it. Binance described the breach as complex and set aside about $6.34 billion for losses. The attack therefore highlights the need to protect endpoints, detect tampering, preserve evidence, and keep protocols resilient as threats evolve.