Binance resumes customer withdrawals after record $6.3bn hack
The FBI identified the Lazarus Group-affiliated 'TraderTraitor' as the perpetrator behind the October 2026 breach.
Quick Look
- Binance has recovered 90% of $6.3bn stolen in a major hack attributed by the FBI to North Korea's TraderTraitor group.
- The exchange pledged to cover the remaining 10% and resumed phased withdrawals, while crypto markets reacted with significant price drops.
AI-generated summary
Why It Matters
The Lazarus Group is a notorious hacking entity previously linked to the 2014 Sony Pictures hack. Binance is utilizing its Secure Asset Fund for Users to mitigate the impact of the theft.
Cryptocurrency exchange Binance says it has replaced 90% of the amount stolen after a record $6.3bn hack of its platform by a group the FBI identified as being backed by North Korea.
The remaining 10% of tokens are less liquid, meaning they may take longer to buy, the company said in a post on X on Saturday. Co-CEO Richard Teng said separately that the company was “committed to covering the remaining 10%” and that “users will not bear the financial impact of this incident”.
Binance suspended user withdrawals after the hack, but said on Sunday that some had resumed and would be rolled out in phases to ensure stability.
The announcement came as the FBI on Saturday confirmed earlier suspicions from private investigators and analysts that a North Korea-affiliated group called TraderTraitor was behind the hack.
TraderTraitor is believed to be part of the Lazarus Group, which gained notoriety in 2014 when it was accused of hacking into Sony Pictures as revenge for The Interview, a film that mocked North Korean leader Kim Jong-un.
“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026,” the law enforcement agency said in a statement.
The FBI added that it had observed “TraderTraitor actors” converting stolen assets into Ethereum, and expected those assets to be laundered further by converting them using decentralised finance and instant swap services.
It said it was urging private sector entities “to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets”.
Teng said on Friday that the breach was a “complex attack” involving a compromised laptop and malicious software designed to delete evidence of its activity, making it harder to trace and investigate.
Binance said it had set aside around $6.34bn of company funds to cover the losses.
“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the company said.
The money spent re-buying tokens came from using part of its $1bn Secure Asset Fund for Users, a bitcoin reserve it holds to protect customers in the event of security breaches, as well as some of its Futures Insurance Fund, and the company’s own corporate treasury, it said on X.
The attack on Binance came as many observers express worries that the ever-expanding capabilities of artificial intelligence models could compromise cryptography and IT security protocols.
Bitcoin plunged nearly 5% after the news of the hack, while Ethereum dropped nearly 6% and BNB, native to Binance, tumbled nearly 10%.
What to Watch
AI outlook — possibilities, not facts
Binance will continue phased restoration of user withdrawals.
Very likely · Within days
Open Questions
- How will the remaining 10% of illiquid tokens be recovered?
- Will there be further international sanctions against North Korea?
