North Korea Behind Record $6.3B Binance Heist

Binance returned to service on Sunday after a cyberattack that resulted in a $6.3 billion loss, triggering a major outflow of customer funds.

The heist occurred last week and represents the largest known financial robbery in history. The Federal Bureau of Investigation attributes the breach to a North Korean state-sponsored unit called TraderTraitor. The exchange has since used its own reserves to replace the stolen cryptocurrency.

The sequence of events began late Thursday when hackers executed the theft in a window of approximately 20 minutes. Analysts from TRM Labs and Chainalysis noted that the timing and method mirrored previous large-scale attacks linked to North Korea. On Friday, crypto prices dropped as Binance worked to reassure its user base. The FBI issued a statement on Saturday identifying the TraderTraitor unit. President Trump later expressed uncertainty about the North Korean connection but promised to engage with Pyongyang if the link was confirmed.

The exchange reported that customers pulled $3.64 billion, which equates to 2.1% of its total assets, as it came back online. Binance stated that withdrawal volumes have since stabilized and that deposit levels remained substantial. A crypto analytics firm called DefiLlama tracked higher outflows of $4.36 billion. A Binance spokesperson noted that their own internal figures exclude flows to a new hot wallet, making their data the most accurate reflection of user activity.

Binance is managing the return of service in phases based on user demand. The initial phase covers 15 tokens, including bitcoin, ether, dogecoin, and specific stablecoins. The company has covered 95% of the stolen assets by purchasing replacement tokens. The remaining 5% consists of less liquid assets that may take more time to source. The exchange set aside $6.34 billion in company funds to cover the losses.

The funds used to buy replacement tokens came from three sources: the Secure Asset Fund for Users, the Futures Insurance Fund, and corporate treasury. Co-CEO Yi He said the company would utilize 50% of the $1 billion SAFU reserve. The company committed to replenishing the SAFU fund to its original size. Co-CEO Richard Teng described the breach as a complex attack involving a compromised laptop and malicious software designed to delete traces of the intrusion.

North Korea has historically denied using state-linked cyber units for financial theft and espionage. Its diplomatic missions in Geneva and China did not respond to requests for comment. The FBI observed the unit converting stolen assets into ether. Law enforcement agencies expect further laundering of the assets through related technology. Binance has worked with other firms to freeze approximately $3 billion of the stolen assets as of Friday.

Binance operates with 335 million registered users globally and held $171 billion in assets under management as of October 28. Founder Changpeng Zhao thanked US law enforcement for their help in tracking and freezing stolen assets. Zhao, who was pardoned by Trump last year after a conviction for failing to maintain an anti-money laundering program, credited US agencies for helping stabilize the market. He noted that many users may not realize the role law enforcement played in preventing a larger drop in bitcoin prices.

The exchange continues to process withdrawals and deposits as it restores full functionality. The company is monitoring the flow of assets to ensure stability. The investigation into the TraderTraitor unit remains active. Binance has not released a specific timeline for when the remaining 5% of stolen assets will be fully replaced.