Cryptocurrency exchange Binance announced that it has successfully replaced 90% of the digital assets stolen during a record $6.3 billion security breach. The platform stated that withdrawals are anticipated to resume on Sunday following a temporary suspension triggered by the cyberattack.
The company explained that the remaining 10% of the compromised tokens consist of less liquid assets, which require additional time to reacquire. Co-CEO Richard Teng emphasized the firm’s stance in a separate statement, affirming that the organization remains fully committed to covering the remaining 10% and ensuring that users do not experience financial losses from the incident.
Simultaneously, the Federal Bureau of Investigation formally attributed the massive digital heist to a North Korea-affiliated cyber collective known as TraderTraitor. Investigators stated that the group is believed to operate as part of the broader Lazarus Group, a syndicate that previously gained international attention for the 2014 cyberattack against Sony Pictures.
According to federal law enforcement, the digital theft occurred on or about October 29, 2026, resulting in the loss of more than $6 billion in virtual assets. The FBI reported tracking TraderTraitor operatives as they converted portions of the pilfered funds into Ethereum, and warned that the actors are expected to utilize decentralized finance platforms and instant swap services to launder the remainder. The agency formally urged private sector organizations to block transactions linked to cryptocurrency addresses associated with the hacking group.
Detailing the mechanics of the breach, Teng noted on Friday that the incident involved a sophisticated, complex operation leveraging a compromised laptop and malicious software engineered to erase activity logs, complicating tracing and forensic efforts.
To finance the massive token buyback, Binance reported drawing upon multiple internal financial reserves. The company utilized resources from its $1 billion Secure Asset Fund for Users—a bitcoin reserve established to shield customers during security emergencies—alongside allocations from its Futures Insurance Fund and corporate treasury reserves, setting aside approximately $6.34bn to absorb the losses.
The unprecedented scale of the cyberattack has intensified global scrutiny regarding North Korea’s cyber warfare capabilities and its reliance on illicit digital revenue streams to circumvent international sanctions and fund its nuclear and missile programs. Market reactions were immediate following the disclosure, with bitcoin falling nearly 5%, ethereum dropping close to 6%, and BNB, Binance’s native token, tumbling roughly 10%.
