Binance Replaces $5.7 Billion in Stolen Crypto After North Korean Hack

Binance has replaced 90 percent of the $6.3 billion in digital assets stolen in a hack attributed to a North Korean group. The exchange stated on Saturday that it covered the majority of the loss using its internal reserves. The remaining 10 percent consists of less liquid tokens that may require more time to repurchase.

Co-chief executive Richard Teng confirmed that Binance is committed to covering the full amount. He stated that users will not bear the financial impact of the incident. The company initially suspended user withdrawals following the breach. On Sunday, Binance announced that withdrawals would resume in phases to maintain platform stability.

The FBI identified the attacker as TraderTraitor, a group linked to the Lazarus Group. The agency said the attack occurred on or about October 29, 2026. TraderTraitor gained international attention in 2014 for hacking Sony Pictures. The FBI noted that the group converted stolen assets into ethereum. It expected the actors to use decentralized finance and instant swap services to launder the funds further.

Teng described the breach as a complex attack on Friday. He said the intruders used a compromised laptop and malicious software designed to delete evidence. This activity made tracing and investigating the attack more difficult. Binance set aside approximately $6.34 billion in company funds to address the losses.

The exchange drew from its $1 billion Secure Asset Fund for Users to buy back the stolen tokens. It also used portions of its Futures Insurance Fund and its corporate treasury. The Secure Asset Fund is a bitcoin reserve held to protect customers during security breaches. The company stated its commitment remains to fully cover the financial impact of the stolen funds.

Market prices reacted sharply to the news. Bitcoin fell nearly 5 percent following the announcement. Ethereum dropped nearly 6 percent, and BNB, the token native to Binance, tumbled nearly 10 percent. The scale of the theft has intensified scrutiny on North Korea's ability to generate illicit revenue despite international sanctions on its nuclear and missile programs.

The FBI urged private sector entities to block transactions derived from addresses used by TraderTraitor actors. The agency said these addresses are currently being used to launder the stolen virtual assets. Binance’s move to cover the losses represents a major drawdown of its protective funds. The exchange continues to monitor the market as it completes the repurchase of the remaining tokens.