Binance’s $6.3B Hack: North Korea Denies It, $3B Gets Frozen, Withdrawals Return 🧊

Binance has said it has restored at least 95% of the assets affected by its $6.3 billion security breach, while withdrawing $7,499 BTC from its Secure Asset Fund for Users as it rebuilds customer balances following the theft on October 29, 2026. The exchange began restoring withdrawals in phases on Sunday and enabled assets across 15 networks, including $BTC, $ETH, $BNB, $XRP and $SOL.

The recovery followed an operation that Binance estimates affected $6.3 billion, with more than $6.34 billion set aside in company funds to cover losses. Of that amount, $5 billion was already held in the same tokens taken during the attack, including USDC, USDT, BTC, ETH and BNB. Binance said the remaining assets were being purchased through market and over-the-counter transactions, while user withdrawals remained subject to congestion, longer processing times and temporary delays.

Binance initially suspected that a compromised DevOps engineer’s laptop gave an attacker access to a service container and allowed unauthorized withdrawal transactions, but later reported “additional points of breach.” Co-CEO Richard Teng said the attacker “did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action.” The exchange also said it had found no evidence of a wallet private-key leak and that Ethereum’s EIP-7702 delegation did not pass through its normal approval controls.

Blockchain analytics firms TRM Labs and Chainalysis attributed the attack to North Korea’s TraderTraitor group, and the FBI later issued a similar finding. The bureau said the hackers were converting stolen assets mainly into Ether and could use DeFi and instant-swap services for further laundering. Industry partners have frozen about $3 billion, including 823 million USDC and more than 1.567 billion USDT, while TRM Labs and Chainalysis estimated the total theft at approximately $6.36 billion and $6.4 billion, respectively.

North Korea denied the FBI’s attribution. Kim Yo Jong called the finding a “grave political provocation against the DPRK that the U.S. misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds.” Binance founder Changpeng Zhao, who no longer manages the exchange, also said: “Binance did not borrow money. Binance did not sell assets. Binance did not raise money. Binance covered from its balance sheet.”