The Binance Hack Explained

The Binance hack is the theft of more than $6 billion in cryptocurrency from Binance, the world's largest cryptocurrency exchange, in late October 2026. The Associated Press described it as the largest cryptocurrency theft on record.

On October 31, 2026, the FBI said North Korean hackers were responsible. Binance said its customers would not lose money because the company would cover the stolen funds.

What Happened?

The theft was discovered around October 29, 2026. Estimates of the amount stolen differ by source and by when the value of the stolen coins was measured. Reported estimates range from about $6.3 billion to about $6.4 billion.

How the Attack Worked

Binance first pointed to a compromised laptop. Co-CEO Richard Teng later said the breach was more complex. According to Teng and a Binance security report, attackers spent months getting inside. In June 2026 they lured an engineer into installing a fake developer tool. In September they posed as recruiters and ran fake job interviews that planted malware. From there they moved through internal AI tools and reached the systems that authorize wallet transfers. Investigators have not released a full independent public account of every step.

Where the Money Went

Investigators say the thieves have been moving the stolen cryptocurrency through many digital wallets and services, such as cross-blockchain "bridges" and instant exchanges, to hide where it came from.

Who Is Blamed?

On October 31, 2026, the FBI attributed the theft to "TraderTraitor," a group of hackers working for the North Korean government. CoinDesk reported that TraderTraitor is part of the larger hacking network often called the Lazarus Group.

North Korea and Crypto Theft

U.S. officials have linked North Korean hackers to many past cryptocurrency thefts. In February 2025, the FBI blamed North Korea for the theft of about $1.5 billion from the exchange Bybit, which had been the largest crypto theft on record until the Binance hack. U.S. officials and United Nations experts have said stolen crypto helps fund North Korea's weapons programs.

The Government Response

The FBI, the U.S. Secret Service, and IRS Criminal Investigation published a list of cryptocurrency addresses linked to the theft, including more than 600 Ethereum addresses, about 20 Bitcoin addresses, and one Solana address. They asked exchanges and other crypto businesses to block transactions from those addresses. The FBI asked anyone with information to report it at ic3.gov.

What Has Binance Done?

Binance paused withdrawals after the theft. Beginning November 1, 2026, the company started resuming withdrawals in phases. Through early November it continued reopening more assets and networks.

Covering the Losses

By November 4, 2026, Binance said it had replenished about 98% of the stolen assets and was still buying the remaining 2%. Those leftover tokens are harder to purchase because they trade less often. Teng said customers would not bear the financial impact.

According to news reports, Binance set aside about $6.34 billion from three sources: its emergency fund for users, its futures insurance fund, and its corporate treasury.

Freezing Stolen Funds

Some companies that issue stablecoins, cryptocurrencies designed to hold a steady value such as $1, froze tokens linked to the theft. Reported totals ranged from about $2.85 billion to about $3 billion, depending on the source and timing. Freezing funds can prevent thieves from moving them, but it does not by itself return them.

What Does It Mean for People Who Hold Cryptocurrency?

The hack has renewed attention on the risks of keeping digital assets on exchanges.

1. Exchange risk: When people keep cryptocurrency on an exchange, the exchange controls the keys to those funds. A hack, failure, or freeze at the exchange can affect customers' access to their money.
2. No federal deposit insurance: Cryptocurrency held on an exchange is not covered by FDIC insurance, which protects deposits at U.S. banks.
3. Reimbursement is voluntary: Binance chose to cover losses in this case. Other exchanges have not always been able or willing to do so.
4. Scams after hacks: Major hacks are often followed by scams, such as fake "refund" messages or websites. Customers should rely only on official company channels.

Self-Custody

Some people choose self-custody, which means holding their own private keys in a software or hardware wallet instead of on an exchange. Self-custody removes exchange risk but makes the owner responsible for protecting the keys. Lost keys usually cannot be recovered.

What Happens Next?

Investigators and blockchain analysis companies are tracing the stolen funds as they move. By early November 2026, the firm Elliptic said the attackers had used more than 20,000 wallets across many blockchains. Recovering stolen crypto is often slow and incomplete.

Details about the attack, the amount recovered, and Binance's operations may change as investigations continue. Figures in this explainer reflect reports as of November 6, 2026.