By Karim Hammam
Binance, the world's largest cryptocurrency exchange by daily trading volume, said Saturday it has replaced 90% of the $6.3bn stolen in a record hack of its platform, as the FBI formally blamed a North Korean state-sponsored group for the attack.
Hack attributed to North Korean group
The breach occurred on or about October 29, 2026. The FBI identified the culprit as TraderTraitor, a group believed to be part of the Lazarus Group notorious for the 2014 Sony Pictures hack. The agency said it observed TraderTraitor actors converting stolen assets into Ethereum and expected further laundering through decentralised finance and instant swap services.
Binance pledges full coverage
Binance co-CEO Richard Teng said the company was “committed to covering the remaining 10%” and that users would not bear the financial impact. The exchange suspended withdrawals after the hack but said it was on track to resume them on Sunday.
Funds drawn from reserves and treasury
The company set aside $6.34bn of its own funds to cover losses, drawing from its $1bn Secure Asset Fund for Users (a bitcoin reserve), its Futures Insurance Fund, and its corporate treasury. Teng described the breach as a “complex attack” involving a compromised laptop and malware designed to delete evidence.
FBI urges blocking of laundering addresses
The FBI urged private sector entities to block transactions linked to addresses used by TraderTraitor for laundering. The announcement came as analysts warned that advancing artificial intelligence capabilities could threaten cryptography and IT security protocols.
Market reaction and geopolitical context
Markets reacted sharply: Bitcoin fell nearly 5%, Ethereum dropped almost 6%, and Binance's native token BNB tumbled nearly 10%. The scale of the heist underscores North Korea's ability to generate illicit revenue despite extensive international sanctions over its nuclear and missile programmes.
