Cryptocurrency giant Binance says it has dipped into its own corporate treasury to buy back tokens to cover 90% of the $6.3 billion stolen in the largest crypto heist in history.
“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the company said Saturday on X.
The world’s largest crypto exchange by daily trading volume said the remaining 10% of tokens are “less liquid, which means they may take longer to source in the required amounts.” The company said it has set aside more than $6.34 billion in company funds to cover losses.
Binance suspended all user withdrawals after the incident but said they were on track to resume Sunday.
The attack was fast, complex and meticulously planned.
According to blockchain intelligence firm TRM Labs, the theft began at around 20:05 UTC on Wednesday, Oct. 29, when hackers moved approximately $6.36 billion out of Binance wallets on ten blockchains — most of it in about 20 minutes. It is more than four times the $1.5 billion stolen from Bybit in February 2025, the previous record. b1044284
Binance’s initial investigation pointed to a compromised DevOps engineer’s laptop which allowed the attacker to gain access to the environment running internal services and then execute unauthorized withdrawal transactions. The company said it found no evidence of any wallet private key leak. 4284
Investigators said the attackers exploited Binance’s “signing infrastructure,” which authorizes transactions and issues instructions, to empty wallets housing customer deposits. b104
The heist was not impulsive. TRM said there were smaller rehearsal thefts in the 36 hours leading up to the main attack, funded with small Tornado Cash withdrawals to test the system. On Ethereum, the attacker used EIP-7702 to turn a Binance hot wallet into a sweeper controlled by the attacker, preparing 50 pre-signed authorizations to ensure one would remain valid.
The loot included 1.768 billion tether (USDT), 18,270 bitcoin, 497,976 ether and about 824.6 million USDC spread across 70 attacker wallets.
Within an hour, stablecoin issuers Tether and Circle moved to freeze assets. Binance said about $3 billion has been frozen on-chain so far, while thieves managed to swap $60 million of stolen Tether to Ether on decentralized platform Aave.
TRM Labs, Chainalysis and Elliptic all attribute the attack with high confidence to TraderTraitor, North Korea’s elite hacking unit. TraderTraitor is a name used by the FBI, CISA and US Treasury to describe hackers who target software developers and IT staff at crypto companies with malicious software.
Researchers say it is part of North Korea’s Lazarus group operating under its Reconnaissance General Bureau, and is regarded as a state-sponsored theft machine funding Pyongyang’s weapons programs. North Korea had already stolen at least $6.75 billion in crypto through end of 2025 before this heist, according to Chainalysis.
The FBI said it is engaged with partners to understand the scope of the activity, while President Donald Trump said Friday the US was looking into the hack.
Binance founder Changpeng Zhao posted “User funds are safe!” but acknowledged the incident “does look like a hack on Binance.”
The attack comes as observers warn that expanding AI capabilities could compromise cryptography and IT security protocols, and has reignited debate over whether even the largest exchanges can safeguard user assets.
