What We Know About Binance’s Record $6.3bn Crypto Hack

Binance, the world's largest crypto exchange by daily trading volume, began letting customers withdraw funds on Sunday after a $6.3 billion theft the FBI says was carried out by a North Korea-linked hacking unit, according to the Guardian, Nov. 1, 2026.

How much was stolen, and how much has Binance replaced?

Binance said it has replenished 90% of the stolen amount, the Guardian reported, citing a company post on X dated Saturday, Oct. 31, 2026. The remaining 10% involves less liquid tokens that "may take longer to buy," the exchange said in that post. Binance co-chief executive Richard Teng told the Guardian the company is "committed to covering the remaining 10%" and that users will not bear the financial impact of the hack.

When did withdrawals resume, and for which tokens?

The theft occurred Thursday, Oct. 29, 2026, prompting Binance to freeze withdrawals while it investigated, per the Guardian. The exchange restarted withdrawals in phases starting at 2 p.m. Singapore time on Sunday, Nov. 1. The first phase covered ethereum, USDT and USDC holdings on the ethereum blockchain, plus some assets on the BNB Smart Chain. Dogecoin and Avalanche trading resumed later Sunday on their respective platforms, the Guardian reported.

Who does the FBI say carried out the hack?

The FBI confirmed Saturday, Oct. 31, that North Korea was responsible, according to the Guardian's account of the bureau's statement. The agency named a group called TraderTraitor, which investigators and private analysts had already flagged as a suspect before the FBI's confirmation. The bureau's statement, as quoted by the Guardian, said: "The Federal Bureau of Investigation is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6bn in virtual asse[ts]."

What is TraderTraitor, and how does it connect to the Lazarus Group?

TraderTraitor is described by the Guardian as part of the Lazarus Group, the North Korea-linked hacking network that drew global attention in 2014 for breaching Sony Pictures in apparent retaliation for "The Interview," a film mocking North Korean leader Kim Jong-un. The Guardian's related reporting has also examined how crypto theft has helped fund North Korea's nuclear program, though that broader financing link was not detailed in the primary Binance story.

Glossary

• TraderTraitor: A North Korea-affiliated hacking group the FBI blames for the Binance theft, identified as a unit within the larger Lazarus Group.
• Lazarus Group: A North Korean state-linked hacking network tied to the 2014 Sony Pictures breach and now to the Binance hack, per the FBI and the Guardian.
• BNB Smart Chain: A blockchain network operated in connection with Binance, on which some withdrawals resumed in the first reopening phase.
• Phased withdrawal: Binance's token-by-token approach to restoring customer access, starting with ethereum, USDT and USDC before adding Dogecoin and Avalanche.

The $6.3 billion figure, if confirmed by further reporting, would mark the largest theft from a cryptocurrency exchange on record, the Guardian noted, though no comparative historical dataset was cited in the original report to benchmark it against prior breaches.