Binance, the world’s largest cryptocurrency exchange, has announced it has successfully recovered and covered 90% of the staggering $6.3 billion (approximately £4.7 billion) in assets that were pilfered in a sophisticated hack on Thursday. The remaining 10% of the stolen funds may necessitate a longer period to source and consolidate in the required amounts, the company stated in a recent update. This assurance comes as Binance has consistently pledged to absorb the full financial impact of any losses incurred by its users, a commitment underscored by the allocation of over $6.34 billion from its own corporate treasury to compensate for the stolen assets. "Binance will absorb the financial impact of these stolen funds, not our users," the company emphatically declared in a statement released on Saturday.
Further compounding the gravity of the situation, the Federal Bureau of Investigation (FBI) officially attributed the massive hack to North Korea on Saturday. This assertion aligns with prior intelligence provided to the BBC by two independent analytics firms, which had presented robust evidence pointing towards the Lazarus Group, a state-backed hacking unit operating under the auspices of North Korea, as the likely perpetrators. The FBI’s direct naming of the Lazarus Group, also known by the moniker TraderTraitor, solidified these suspicions. Binance confirmed that it has replenished the stolen assets through a combination of various recovery funds and its own corporate treasury. The company has provided explicit assurances that all holdings of widely traded cryptocurrencies, including Bitcoin, Ethereum, and Tether, are fully covered, alongside seven other major digital assets.
Looking ahead, Binance’s immediate priority is the resumption of withdrawal services for its users. The company indicated that it remains on track to reopen these critical services on Sunday, November 1st, with a further update to be provided once the precise details are confirmed. This hack is now widely believed to be the largest in the history of cryptocurrency, eclipsing the previous record of a $1.5 billion heist that targeted the Bybit exchange in 2025, an incident for which the FBI also implicated North Korea. It is important to note that North Korea has consistently denied any involvement in these types of cyberattacks.
Binance’s initial investigation into the breach suggested that a compromised engineer’s laptop provided the initial point of access, facilitating unauthorized withdrawals. However, a subsequent update revealed that the exchange had uncovered "additional points of breach," indicating a more extensive and multifaceted attack vector. Richard Teng, Binance’s co-chief executive officer, elaborated on the attack, stating that it was executed by more than one individual and that the hackers employed highly sophisticated methods to obscure their actions, including the use of a "self-destruct mechanism" to erase their digital footprints.
In a significant development on Friday, Binance announced that it had successfully frozen approximately $3 billion of the stolen assets, a feat achieved through extensive collaboration with law enforcement agencies, intelligence firms, and various industry partners. The investigation into the hack is reported to be ongoing, with the US Secret Service confirming on Friday that it is "working around the clock" with private sector partners to "identify, freeze, trace, and recover funds" that were illicitly removed from Binance.
Founded in China in 2017, Binance has rapidly ascended to become a global powerhouse in the cryptocurrency landscape, enabling millions of users worldwide to buy, sell, and trade a diverse array of digital assets. The platform’s reach and influence are substantial, with an estimated user base numbering in the hundreds of millions. Cryptocurrency, by its nature, represents a digital asset that lacks a physical form, existing solely within the digital realm and accessed through digital wallets or computer systems.
The scale of the Binance hack underscores the persistent and evolving threat posed by sophisticated cybercriminals, particularly state-sponsored actors, to the burgeoning digital asset ecosystem. The swift and decisive action by Binance to cover user losses, coupled with the collaborative efforts of international law enforcement and cybersecurity firms, demonstrates a growing resilience within the industry to combat such threats. However, the attribution to North Korea highlights the geopolitical dimensions of cyber warfare and the ongoing challenge of holding state actors accountable for illicit activities. The incident serves as a stark reminder of the inherent risks associated with digital assets and the paramount importance of robust security measures and proactive threat mitigation strategies for both exchanges and individual users. The ongoing investigation will likely uncover further details about the attack’s methodology and the intricate network of individuals and entities involved, potentially leading to more significant implications for the global cybersecurity landscape and international relations. The ability of Binance to absorb such a colossal financial blow, while distressing, also speaks to the significant financial reserves and strategic planning that underpin the operations of major cryptocurrency exchanges. The continued focus on recovering the remaining 10% of the stolen funds, alongside the reopening of withdrawal services, will be crucial in maintaining user confidence and reinforcing Binance’s position as a leading player in the cryptocurrency market. The long-term implications of this hack may also spur further regulatory scrutiny and innovation in cybersecurity protocols within the digital asset space, aiming to prevent future occurrences of such magnitude.







