Binance recovers most of $6.3 billion stolen in cyberattack

29, 2026. The exchange is currently working with over-the-counter providers to restore the remaining 5% of funds, which consist of less liquid tokens.

The theft, which occurred over a 20-minute window, involved unauthorized withdrawals across 10 blockchains. Investigations suggest the breach may have been initiated through a compromised employee laptop. In response to the incident, Binance suspended withdrawals, beginning a phased resumption of services on Nov. 1, 2026.

The Federal Bureau of Investigation has attributed the attack to TraderTraitor, a hacking group linked to North Korea. While U.S. officials have pointed to North Korean state-sponsored actors, the North Korean government has denied involvement, with official Kim Yo Jong dismissing the allegations as absurd rhetoric.

Binance is utilizing its corporate treasury, the Secure Asset Fund for Users, and its futures insurance fund to cover the losses. According to the company, approximately $3 billion of the stolen assets have been frozen on-chain through coordination with law enforcement and industry partners.

Addressing the financial impact, Teng stated that the company remains in strong financial health and is capable of covering the losses. He noted that the exchange plans to release a full technical post-mortem of the incident in the future as it works to move forward from the breach.