Binance said about $6.3 billion in client assets was affected by a theft on October 29, 2026. The FBI attributed it to North Korea's TraderTraitor group, and North Korea rejected the claim. Binance said it would cover user losses and reopened withdrawals network by network from November 1.
This page collects our coverage of the theft and its aftermath, newest first.
The financial regulator said it will issue a no-action letter covering pre-emptive suspensions and told exchanges to monitor around the clock, two weeks after the Binance hack. The release does not list the letter's conditions or give a date for it.
The FBI, Secret Service, and IRS investigators urged exchanges and DeFi services to block transactions tied to 628 addresses used to launder the stolen funds.
The exchange paused withdrawals on October 29, began reopening them on November 1 and said it would absorb the losses. Independent estimates of the haul range from about $6.36 billion to $6.43 billion.
Binance says it covered the record theft from its own funds, and stablecoin freezes blunted it. The episode also showed how quickly access to funds can disappear.
Binance first said a compromised engineer's laptop may have been involved and that it found no evidence of leaked private keys. Its November 3 report described a months-long intrusion.
About 117,000 NEAR, worth around $430,000, passed through six home-made tokens launched between November 5 and 7. The amounts are small, but the technique is cheap and slows down investigators.
Elliptic says $2.85 billion of the $6.43 billion haul is frozen or seized and that only a negligible amount has likely been cashed out so far.
Withdrawals of INJ, PLASMA, NEAR, and LTC are next on the list. Binance has not published a complete list of the assets that remain restricted in its latest notice, crypto.news noted.
Bitcoin withdrawals came back first on November 1. Users pulled a net $3.6 billion between 06:00 and 15:30 UTC that day, according to figures Binance shared.
BNB, the native token of the Binance-linked BNB Chain, fell about 8% and Bitcoin close to 5% in the hours after the theft began at 20:05 UTC on October 29.
Kim Yo Jong, the sister of leader Kim Jong Un, rejected the FBI's attribution in a statement carried by state media. According to published excerpts, she offered no technical rebuttal.
Tether and Circle acted within hours of the October 29 theft. Ripple said it was freezing RLUSD as well, without giving an amount.
