Binance, the world’s largest cryptocurrency exchange, announced on Saturday that it has reimbursed users for 90% of the $6.3 billion stolen in what is being called the biggest crypto hack on record. While the company has set aside more than $6.34 billion to cover the loss, the final 10% of the stolen assets may take longer to recover.
What happened
The breach, which occurred on Thursday, involved unauthorized withdrawals that security investigators traced back to a compromised engineer’s laptop. Binance later reported “additional points of breach,” suggesting that more than one individual was involved. Co‑CEO Richard Teng described the attackers as using sophisticated methods, including a “self‑destruct mechanism,” to hide their tracks.
Binance’s response
In line with its pledge to cover 100% of the loss, Binance has already replenished the stolen assets using a combination of corporate treasury funds and other reserves. The exchange confirmed that holdings of Bitcoin, Ethereum, Tether and seven other widely‑traded crypto assets are fully covered. It also froze around $3 billion of the stolen funds after collaborating with law‑enforcement agencies, the U.S. Secret Service, and private‑sector partners.
Binance’s next operational goal is to resume withdrawal services for its users. The company said it remains on track to reopen withdrawals on Sunday, 1 November, and will issue a further update once the details are confirmed.
Broader implications
The hack eclipses the previous record $1.5 billion theft at the Bybit exchange in 2025, underscoring the growing scale of cyber‑crime in the crypto sector. Two major blockchain‑analytics firms have pointed to the North Korean state‑backed Lazarus Group (also known as TraderTraitor) as the likely perpetrators. The FBI has previously linked North Korea to the Bybit theft, adding weight to these suspicions.
For the broader crypto ecosystem, Binance’s swift reimbursement demonstrates a willingness among leading exchanges to absorb financial shocks to protect users. However, the incident also highlights the systemic vulnerabilities that persist despite advanced security measures. The fact that an engineer’s laptop could serve as an entry point raises questions about internal controls and the need for more robust multi‑factor authentication and hardware security modules.
Uncertainty and next steps
While Binance has covered the majority of the loss, the remaining 10% of the stolen assets—approximately $630 million—still needs to be sourced. The timeline for this recovery is unclear, and it will depend on ongoing investigations, cooperation with international law‑enforcement, and the ability to trace the frozen $3 billion.
Furthermore, the attribution to the Lazarus Group remains “robust intelligence” rather than a definitive legal finding. Ongoing forensic analysis and diplomatic negotiations will be required to confirm the culprits and potentially recover additional funds.
What users should watch for
- Withdrawal status: Users should monitor Binance’s announcements for the exact time withdrawals will resume.
- Security updates: Expect heightened security protocols, including possible mandatory password resets and two‑factor authentication enhancements.
- Regulatory scrutiny: Regulators worldwide may increase oversight of crypto exchanges, potentially leading to new compliance requirements.
As the investigation continues, Binance’s handling of the fallout will likely set a benchmark for how major crypto platforms respond to large‑scale breaches. The industry, regulators, and users alike will be watching closely to see whether the remaining funds can be recovered and how future attacks might be prevented.