Binance covers $6.34 bn hack losses linked to North Korean hackers

Binance has completed the replacement of cryptocurrency assets affected by its October 29, 2026 security breach, committing more than $6.34 bn in company funds to cover losses from what blockchain investigators describe as the largest cryptocurrency theft on record.

The attack compromised Binance’s internal wallet-signing infrastructure, allowing hackers to transfer digital assets from several hot wallets across multiple blockchains. Investigators have linked the operation to TraderTraitor, a North Korean cybercrime group.

• Hackers exploited Binance’s wallet-signing service after compromising employee devices through fake recruitment interviews, malware and internal AI tools.
• Blockchain analytics firm Chainalysis attributed the $6.34 bn theft to North Korea’s TraderTraitor group, identifying connections to previously stolen cryptocurrency.
• Binance has covered affected assets using corporate funds, SAFU reserves and surplus futures insurance funds, while restoring withdrawals gradually.

Binance said approximately $2.85 bn in stolen assets had been frozen or intercepted as of November 3. The exchange subsequently completed the replenishment of affected token balances and published a new proof-of-reserves snapshot on November 12.