Binance says it has repurchased 90% of crypto lost in $6.3bn hack

The exchange used its own funds to buy back most of the stolen tokens and pledged to cover the remainder, while the FBI linked the breach to a North Korean hacking unit.

By Felo News Desk · Published Sun, 01 Nov 2026 03:30:37 GMT

Binance announced on Saturday that it has repurchased 90% of the cryptocurrency taken in the record $6.3 billion hack of its platform, using company reserves. The remaining 10% consists of less‑liquid tokens that may take longer to replace.

What happened

The breach, which began on Thursday after 20:00 GMT, lasted about 20 minutes and affected wallets on ten blockchains, resulting in the theft of roughly $6.3 billion. Binance froze about $3 billion of the stolen assets and halted user withdrawals. By Saturday the exchange said it was on track to resume withdrawals on Sunday.

What the reports add

The Guardian noted that the FBI identified a North Korea‑backed group called TraderTraitor, linked to the Lazarus Group, as the perpetrators and said the FBI observed “TraderTraitor actors” converting the stolen assets into Ethereum before further laundering via DeFi and instant‑swap services.
Times Now News reported that the FBI warned crypto platforms to block transactions from specific addresses used by the hackers, and highlighted that the same group was behind last year’s $1.5 billion Bybit hack.
The Independent added that Binance used part of its $1 billion Secure Asset Fund for Users (SAFU), its Futures insurance fund and corporate treasury to fund the repurchases, setting aside roughly $6.34 billion internally.
The Independent also detailed a new proof‑of‑reserves snapshot taken at 00:00 GMT on October 31, covering ten listed tokens (BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, ZEC) with a minimum 1:1 backing.
Ari Redbord, chief policy officer at TRM Labs, told Times Now News the hackers were likely to split the funds into smaller amounts and move them through smaller exchanges, calling the theft “bank robbery…at the speed of the Internet.”

What was said

"We've now replenished 90% of the stolen assets, and we're committed to covering the remaining 10%. Our users will not bear the financial impact of this incident," co‑CEO Richard Teng said on X, as reported by the Guardian and the Independent.

"The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance," the FBI statement read, cited by the Guardian.

"TraderTraitor actors" are "responsible for malicious cyber activity" and exchanges are urged to "block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets," the FBI warned, per Times Now News.

"It's bank robbery, in this case, at the speed of the Internet," Ari Redbord said. "However, we can also track and trace those funds in real time in order to build investigations, to disrupt and to seize back funds. It's just this cat and mouse game," he added.

How it came about

The hack follows a series of investigations that linked the attack to North Korean actors. Felo News previously reported on 30 October that the TraderTraitor unit was suspected and that Binance had frozen $3 billion of the assets. Earlier coverage also detailed the use of compromised signing infrastructure and social‑engineering tactics by the attackers, who posed as developers or investors to gain access before executing the 20‑minute cross‑chain theft.

Key facts

Binance has repurchased 90% of the cryptocurrency stolen in the $6.3 billion hack. (theguardian.com)
The FBI attributed the hack to a North Korean group called TraderTraitor. (timesnownews.com)
Co‑CEO Richard Teng said Binance will cover the remaining 10% of the losses. (independent.co.uk)