How much of the Binance $6.3bn hack has been recovered?
Binance has successfully replenished 90% of the assets stolen during the massive security breach that occurred on Thursday. The exchange confirmed it has utilized its own corporate treasury and various internal funds to cover the vast majority of the $6.3bn (£4.7bn) loss. While the company has met the needs of most users, it noted that sourcing the remaining 10% of the required funds may take a longer period to finalize.
The exchange's primary objective remains the protection of its client base. In an official statement released on Saturday, Binance emphasized that the company would absorb the total financial impact of the theft rather than passing the losses on to its users. To support this commitment, Binance has set aside more than $6.34bn specifically to address the fallout from this incident.
Coverage of specific digital assets
The replenishment efforts have already secured several major cryptocurrency holdings. According to the company, all user holdings for Bitcoin, Ethereum, and Tether have been fully covered. Additionally, seven other widely-traded crypto assets have been secured through the exchange's recovery funds. This targeted approach aims to stabilize the most liquid parts of the ecosystem first to maintain market confidence.
What caused the breach and how did it happen?
The investigation into the breach suggests a complex, multi-layered attack that bypassed standard security protocols. Initial findings from Binance indicated that a single engineer's laptop may have been compromised, providing a gateway for unauthorized withdrawals. However, as the investigation progressed, the company identified "additional points of breach," suggesting a much wider systemic vulnerability than a single device compromise.
Richard Teng, the co-chief executive officer of Binance, described the operation as a coordinated effort involving multiple actors. The attackers utilized highly sophisticated methods to obfuscate their activities, including the deployment of a "self-destruct mechanism" designed to erase traces of their intrusion. This level of technical complexity highlights the evolving nature of threats facing digital asset platforms.
Who is suspected of carrying out the attack?
Blockchain intelligence and law enforcement agencies are currently focusing their investigations on state-sponsored actors. Two prominent blockchain analytics firms have reported that they possess robust intelligence linking the hack to The Lazarus Group, a North Korean state-backed hacking collective also known as TraderTraitor. This group is frequently associated with high-level cyber warfare and large-scale financial theft.
The investigation is being supported by several high-level international agencies. The US Secret Service stated on Friday that it is working continuously with private sector partners to identify, trace, and recover the stolen funds. This follows a precedent set by the FBI, which previously linked North Korea to a $1.5bn theft on the Bybit exchange in 2025. While North Korea has consistently denied involvement in such cyberattacks, the pattern of sophisticated, large-scale heists remains a significant concern for global regulators.
What is the status of user withdrawals and fund security?
Binance is currently working toward resuming normal operations, with a specific focus on reopening withdrawal services. The exchange stated it remains on track to allow users to withdraw their assets starting Sunday, 1 November. A further update will be provided to the community once the specific technical details and security confirmations are finalized.
In terms of asset recovery, the exchange has already made significant progress in freezing the movement of the stolen wealth. On Friday, Binance announced that it had successfully frozen approximately $3bn of the stolen assets. This was achieved through close collaboration with law enforcement agencies, intelligence firms, and various industry partners. The ability to freeze such a large portion of the funds early in the investigation is seen as a critical step in mitigating the total loss.
How does this hack compare to previous crypto thefts?
The scale of the Binance incident eclipses all previous records in the cryptocurrency sector. With a total loss estimated at $6.3bn, this event surpasses the $1.5bn heist on the Bybit exchange that occurred in 2025. The sheer magnitude of the theft places it as potentially the largest hack in the history of digital assets.
The impact of such a breach extends beyond the immediate financial loss to the exchange. It raises fundamental questions regarding the security of centralized exchanges and the ability of even the largest players to defend against state-sponsored, multi-point attacks. The incident serves as a stark reminder of the systemic risks inherent in the digital asset market, where the lack of physical existence means security relies entirely on digital protocols and human oversight.
Frequently asked questions
Will Binance users lose their money due to the hack?
No, Binance has stated that it will absorb the financial impact of the stolen funds. The company has committed to covering 100% of the losses using its corporate treasury and other funds, ensuring that users do not bear the cost of the $6.3bn theft.
When will Binance allow users to withdraw funds again?
Binance is currently working to resume withdrawal services. The company has indicated that it is on track to reopen these services on Sunday, 1 November, though it will provide further updates once all security details are confirmed and the process is ready.
Who is believed to be behind the attack?
Major blockchain analytics firms have pointed to The Lazarus Group, a North Korean state-backed hacking group known as TraderTraitor, as the likely culprits. The investigation is ongoing, and law enforcement agencies are working to confirm these intelligence reports.
How much of the stolen money has been frozen?
Binance reported on Friday that it had successfully frozen approximately $3bn of the stolen assets. This recovery effort was conducted in partnership with law enforcement, intelligence firms, and various industry partners to prevent the movement of the stolen funds.
What was the primary method used to breach Binance?
The breach involved multiple points of entry, including a suspected compromise of an engineer's laptop. The attackers used sophisticated methods, such as a "self-destruct mechanism," to hide their tracks and bypass security measures during the unauthorized withdrawals.
Key takeaways
- Binance has covered 90% of the $6.3bn stolen in a major hack.
- The exchange has allocated over $6.34bn in funds to protect its users.
- The Lazarus Group, a North Korean state-backed entity, is a primary suspect.
- Approximately $3bn of the stolen assets have already been frozen.
- Withdrawal services are expected to resume on 1 November.
The evolving landscape of cryptocurrency security
The Binance $6.3bn hack marks a turning point in the history of digital asset security. While the exchange's ability to cover 90% of the losses demonstrates a robust financial cushion, the sophistication of the attack highlights a growing vulnerability to state-sponsored cybercrime. As hackers move from single-point compromises to multi-layered, coordinated strikes using self-destructing code, the industry must evolve. The collaboration between private exchanges and international law enforcement, such as the US Secret Service, will be essential in navigating this increasingly complex and high-stakes digital frontier.
