The Binance hack, which resulted in approximately $6.3 billion worth of cryptocurrency being stolen, has raised fresh concerns about the security of digital assets after the world’s largest cryptocurrency exchange temporarily suspended withdrawals. The FBI has attributed the October 29 attack to North Korea, while Binance says it has replaced approximately 95 per cent of the affected assets and begun restoring withdrawal services.
The incident, one of the largest cryptocurrency thefts reported, involved unauthorised transactions from Binance’s hot wallets, prompting an emergency security response and an investigation involving international law enforcement agencies and blockchain security experts.
On Sunday, November 1, Binance announced that withdrawals were gradually returning after the exchange completed security assessments and replenished most of the stolen assets.
However, questions remain about how the attackers gained access to the platform’s infrastructure and moved such a significant amount of cryptocurrency without immediate detection.
How Hackers Stole $6.3 Billion From Binance
Binance disclosed that the security breach occurred at approximately 20:05 UTC on October 29, 2026, when its hot wallets were compromised.
Hot wallets are cryptocurrency wallets connected to the internet, allowing exchanges to process transactions and facilitate withdrawals. Unlike cold wallets, which are kept offline, hot wallets provide quicker access to digital assets but require strong security controls to prevent unauthorised access.
In its initial investigation, Binance suggested that the attack might have involved a compromised laptop belonging to a DevOps engineer.
A DevOps engineer works with the systems and infrastructure that keep digital platforms running. According to Binance’s October 30 security announcement, the compromised laptop allegedly allowed the attacker to gain access to a service container and submit unauthorised withdrawal transactions.
This meant the attackers could exploit access to Binance’s internal systems to move funds without necessarily obtaining users’ wallet passwords or private keys.
Binance subsequently disclosed that further investigations had uncovered additional points of compromise, suggesting that the attack was more complex than initially suspected.
The exchange also said it had found no evidence that cryptocurrency wallet private keys were leaked.
Although the company has identified the initial suspected entry point, it has yet to publish a complete technical explanation of how the attackers moved through its systems and executed the transactions.
FBI Blames North Korea for Binance Cryptocurrency Theft
The Federal Bureau of Investigation(FBI) officially attributed the theft to North Korea in a cybersecurity announcement published on October 31.
The agency identified the operation as TraderTraitor, a name used to describe North Korean state-sponsored cyber activities targeting cryptocurrency businesses and blockchain-related companies.
According to the FBI, the attackers stole more than $6 billion in virtual assets from Binance on or around October 29.
The investigation also revealed that the stolen cryptocurrency was being converted primarily into Ethereum (ETH), a digital currency that operates on the Ethereum blockchain.
The FBI said it had observed the attackers converting the stolen assets and warned that further laundering could take place through decentralised finance (DeFi) platforms and instant cryptocurrency swap services.
DeFi platforms allow users to conduct financial transactions through blockchain-based systems without relying on traditional financial institutions. Instant swap services also allow cryptocurrency holders to exchange one digital asset for another.
The FBI, working with the United States Secret Service and the Internal Revenue Service’s Criminal Investigation division, urged cryptocurrency businesses, blockchain operators and other service providers to block transactions connected to wallet addresses associated with the stolen funds.
The operation is particularly significant because cryptocurrency transactions are recorded on public blockchains, allowing investigators to follow the movement of funds between wallet addresses, even when the identities behind those addresses are not immediately known.
Binance Suspends Withdrawals After the Attack
Following the discovery of the breach, Binance temporarily suspended withdrawals as a precaution while its technical teams investigated the incident and secured affected infrastructure.
The suspension prevented customers from moving their cryptocurrency out of the exchange during the security review.
However, Binance clarified that deposits and other platform services unaffected by the incident remained operational.
The exchange also revoked affected authorisations, introduced additional security controls and began working with law enforcement agencies, blockchain intelligence firms and cryptocurrency issuers to trace the stolen assets.
In its October 30 update, Binance disclosed that approximately $3 billion worth of affected assets had already been frozen on-chain through coordinated recovery efforts.
The exchange also committed to covering the financial impact of the theft rather than passing the losses on to customers.
Binance Replaces 95% of Stolen Cryptocurrency
As part of its recovery efforts, Binance began purchasing replacement tokens through cryptocurrency markets and over-the-counter (OTC) transactions.
The exchange initially reported that it had covered approximately 80 per cent of the affected amount before increasing the figure to 90 per cent.
In its November 1 recovery update, Binance announced that it had covered approximately 95 per cent of the stolen assets.
The remaining five per cent consists of tokens outside the ten most widely held assets identified in its update. Binance explained that these cryptocurrencies have lower market liquidity, making it more difficult to obtain the required quantities quickly.
The company also confirmed that major assets, including Bitcoin (BTC), Ethereum (ETH), BNB, Solana (SOL), USDT, USDC, XRP and Zcash (ZEC), were fully backed.
Binance said its Secure Asset Fund for Users (SAFU) and corporate treasury would be used to absorb the financial impact.
The exchange stated: “Binance will bear the financial impact of the stolen funds.”
This means the company intends to replace the affected assets rather than make customers responsible for the losses.
Binance Resumes Crypto Withdrawals in Phase
On November 1, Binance announced the gradual restoration of withdrawal services following additional security assessments.
The first phase included major cryptocurrencies and networks such as Bitcoin, Ethereum, BNB, Solana, XRP, Dogecoin and several stablecoins.
The exchange explained that services would return progressively as individual networks and assets passed the necessary security and operational checks.
It also warned that customers might experience temporary delays or longer processing times during the initial restoration because of increased transaction volumes.
Binance said it would continue adding more assets and networks as they became ready.
The company also promised to publish a detailed post-incident report after completing its investigation, providing further information about the breach and the security measures introduced to prevent similar attacks.
What the Binance Hack Means for Cryptocurrency Security
The Binance incident has highlighted the risks associated with keeping large quantities of digital assets within internet-connected systems.
Although cryptocurrency transactions operate on blockchain networks, exchanges rely on additional infrastructure, including computers, software, access permissions and transaction-processing systems.
A weakness in these supporting systems can expose digital assets even when the underlying blockchain remains operational.
The incident also demonstrates why cryptocurrency exchanges need strong internal security controls, continuous monitoring and strict restrictions on access to sensitive systems.
For Binance, restoring withdrawals is an important step towards normal operations, but the full investigation remains significant.
With the FBI attributing the attack to North Korea and millions of cryptocurrency transactions under scrutiny, attention will now turn to the recovery of the stolen assets and the security changes Binance introduces following one of the largest thefts in the cryptocurrency industry’s history.
