Binance has confirmed what it describes as the largest hack in the history of the cryptocurrency industry, estimating the scale of the breach at approximately $6.3 billion. The exchange has already frozen about $3 billion of the compromised funds and has pledged to cover all losses using its SAFU insurance fund and its own resources.
Details of the Security Breach
According to preliminary findings from Binance, the attack may have originated from a compromised laptop belonging to a DevOps engineer. This allowed attackers unauthorized access to an internal service container, from which funds were illicitly withdrawn. External blockchain analytics firms TRM Labs and Chainalysis have linked the incident to TraderTraitor, a North Korean group associated with Lazarus. The FBI previously named this group as responsible for a $1.5 billion theft from Bybit in February 2025. Binance itself has not officially named any suspects.
Operational Impact and Recovery
Binance reports that deposit operations are already functioning normally. The exchange expects to resume withdrawals within 48 hours, aiming to restore full platform functionality promptly. The company has reassured users that any losses will be fully compensated, drawing on its SAFU fund and corporate reserves.
Why This Matters for the Industry
This incident highlights ongoing security challenges for major exchanges and their users. For operators, the breach underscores the need for robust internal controls and rapid response capabilities. Affiliates and partners may face questions about the safety of funds and the reliability of exchange services, potentially affecting user trust and engagement. Regulators are likely to scrutinize the event and may consider new guidelines or requirements for crypto platforms to strengthen cybersecurity and consumer protections.
Key takeaways
- Binance confirms a $6.3bn hack, the largest in the crypto sector to date.
- About $3bn in stolen funds have been frozen.
- Losses will be covered by Binance's SAFU fund and company reserves.
- Withdrawals are expected to resume within 48 hours.
Update (03.11.2026)
The FBI has officially attributed the Binance hack to North Korea, specifically naming the TraderTraitor group, a subset of the Lazarus collective, as responsible. According to the FBI, the stolen assets are primarily being converted into Ethereum (ETH) and are expected to be further laundered through DeFi and instant crypto swap services. The bureau has urged the industry to block transactions involving addresses used by TraderTraitor for laundering and has published a comprehensive list of these addresses on its website. Meanwhile, Binance has restored 95% of the stolen reserves—nearly $6 billion—with major cryptocurrencies (BTC, ETH, USDT) now fully backed. The remaining 5%, mainly low-liquidity tokens, are still being replenished as Binance continues to acquire them on the market.