Is your money safe on Binance after the hack? For now, the exchange says yes. Binance, the world's biggest cryptocurrency exchange, lost about 6.3 billion dollars in crypto in an attack that began late on Thursday 29 October, and it says it has already covered 95 percent of the stolen assets with its own money. Withdrawals reopened in phases on Sunday 1 November, starting with bitcoin and ether, according to Reuters reporting published by CNA.
The FBI has blamed North Korea's TraderTraitor hacking unit, making this what analysts believe may be the largest financial robbery in history, digital or otherwise. Yet bitcoin has held above 78,000 dollars and customers have pulled only about 2.1 percent of Binance's assets. How the exchange managed the first 72 hours is now a case study in crisis response, and a warning for the millions of retail traders across Asia who keep their savings on a single platform.
How the biggest crypto heist unfolded
The bulk of the theft unfolded in around 20 minutes beginning late on Thursday, and it bore similarities to earlier large attacks blamed on North Korea, according to US blockchain analysis firms TRM Labs and Chainalysis. Binance co-chief executive Richard Teng described a "complex attack" involving a compromised laptop and malicious software designed to delete evidence of its activity, which made the breach harder to trace and investigate.
On Saturday 31 October, the FBI said the North Korean state sponsored unit known as TraderTraitor was responsible. Law enforcement observed members of the unit converting stolen assets into ether, the bureau said, and it expected "further laundering" of the funds. US President Donald Trump struck a more cautious note the same day. "We don't know if it's North Korea, but if it is, we'll talk to North Korea about it," he told reporters.
Pyongyang has for years denied using state linked cyber units for theft or revenue generation, and its mission in Geneva and embassy in China did not respond to requests for comment. Binance, which was founded in China, thanked the FBI in a post on X but did not respond to a request for comment on North Korea's involvement.
How Binance covered 6 billion dollars in three days
Binance said it had covered 6 billion dollars of the stolen cryptocurrency by using company money to buy replacement tokens. The remaining 5 percent consists of less liquid assets that may take longer to source in the required amounts. The exchange set aside about 6.34 billion dollars of company funds internally to cover the losses and has repeatedly said it, not its customers, would bear the financial impact.
The money came from three pots: its 1 billion dollar Secure Asset Fund for Users, known as SAFU, a reserve built for exactly this kind of breach; part of its Futures Insurance Fund; and its corporate treasury. Co-chief executive Yi He said half of the SAFU fund would be used and committed to replenishing it to about 1 billion dollars. Binance also said about 3 billion dollars of affected assets had been located with industry partners as of Friday, which may allow some funds to be frozen.
Withdrawals restarted in stages, prioritising tokens by user demand over the previous week. The first phase covered 15 crypto assets, including bitcoin, ether, XRP, BNB, dogecoin and some USDT and USDC stablecoins, with bitcoin withdrawals resuming shortly after 06:00 GMT on Sunday. "Rest assured that market conditions are stable," the exchange said in a post on X.
A hack this size would once have ended an exchange. Binance turned it into a solvency test and passed the first round by paying before customers could panic.
Did customers run for the exits?
Not on the scale many feared. Customers pulled 3.64 billion dollars, or 2.1 percent of the exchange's assets, after it reopened, and Binance said withdrawals were stabilising after an initial spike while deposits remained "substantial". It reported 171 billion dollars in total assets under management as of 28 October, according to CNA.
Independent data told a slightly different story. Crypto analytics platform DefiLlama showed higher net outflows of 5.81 billion dollars, up from 4.36 billion dollars earlier. A Binance spokesperson said the DefiLlama figure did not include flows into the exchange's new hot wallet and was therefore not accurate. The gap shows how hard it is for customers to verify an exchange's real position in the middle of a crisis.
Some users chose to hedge rather than flee. Jay Koh, vice president at the Asia Web3 AI Association, said he had not withdrawn his holdings because most were in a cold wallet unaffected by the hack. "I do think it is prudent to review exposure, diversify custody arrangements and avoid keeping more assets on any single platform than necessary," he said.
The market damage: ETFs, stablecoins and liquidations
Bitcoin hit a six week low on Friday before recovering above 78,000 dollars on Monday 2 November, while ether touched a two month low and recovered to about 2,287 dollars. The combined market value of the two largest stablecoins, USDT and USDC, fell by about 1.2 billion dollars after Friday, a sign that some money was leaving crypto altogether.
Spot bitcoin exchange traded funds shed 643 million dollars on Friday, their largest daily outflow of October, and more than 1.3 billion dollars of leveraged positions were liquidated, said Ari Redbord, global head of policy at TRM Labs. "A hack at a crypto exchange is bank robbery at the speed of the internet, which creates an unstable risk profile for anyone responsible for other people's capital," he said.
Binance founder Changpeng Zhao, who was convicted in the US of failing to maintain an effective anti money laundering programme before being pardoned by Trump last year, credited US law enforcement with tracking and freezing stolen assets. He suggested that help was part of the reason bitcoin did not fall further.
Who TraderTraitor is and why North Korea keeps winning
TraderTraitor is a North Korean hacking operation linked to the broader Lazarus Group, which became notorious for the 2014 hack of Sony Pictures. Its members often pose as recruiters offering lucrative jobs to trick employees into downloading malicious software, according to AFP reporting on CNA. In the 308 million dollar theft from Japan's DMM Bitcoin in 2024, a hacker posing as a recruiter on LinkedIn sent a fake pre employment test containing malicious code. The track record linked to Lazarus and TraderTraitor includes:
- 81 million dollars from Bangladesh's central bank in 2016
- About 620 million dollars from the Ronin blockchain network in 2022
- Nearly 200 million dollars from Atomic Wallet, Alphapo and CoinsPaid in 2023
- About 1.5 billion dollars from the Bybit exchange in February 2025
- About 6.3 billion dollars from Binance in October 2026
South Korean authorities estimated in 2024 that North Korea's cyber force numbered around 8,400 people. A 2024 United Nations report said proceeds from its cyberattacks reportedly helped fund weapons of mass destruction programmes. Attackers of all kinds stole 2.9 billion dollars in crypto across nearly 150 incidents last year, according to TRM Labs, which puts the Binance loss at more than double that total in a single night. We tracked the same pattern earlier this year in our report on North Korea's crypto thefts topping 1 billion dollars.
What Asian crypto users should do now
For retail traders across Southeast Asia, where offshore exchanges are widely used, the lesson is about concentration risk rather than any single platform. Binance had the reserves to absorb a 6.3 billion dollar loss; a smaller exchange would not. Spreading holdings, using cold storage for long term savings and watching for phishing messages that exploit the news are basic steps.
The episode also hands regulators across the region a fresh argument for licensing, reserve requirements and proof of assets. Exchanges that can show customers, in real time, that holdings are backed will have an easier time keeping trust when the next attack comes, as it almost certainly will.
How much was stolen in the Binance hack?
About 6.3 billion dollars in cryptocurrency was stolen in an attack that began late on 29 October 2026.
Who hacked Binance?
The FBI said North Korea's state backed TraderTraitor unit was responsible. US President Donald Trump said it was not yet certain.
Is my money safe on Binance?
Binance says it covered 95 percent of the stolen assets with its own funds and that customers will not bear the losses.
Has Binance resumed withdrawals?
Yes. Withdrawals resumed in phases on 1 November, starting with 15 tokens including bitcoin, ether, XRP and dogecoin.
How did Binance cover the losses?
It bought replacement tokens using its SAFU reserve, part of its Futures Insurance Fund and its corporate treasury.
What is the Binance SAFU fund?
The Secure Asset Fund for Users is a reserve of about 1 billion dollars held to protect customers after security breaches.
How much money left Binance after the hack?
Binance said customers pulled 3.64 billion dollars, or 2.1 percent of its assets. DefiLlama showed 5.81 billion dollars.
How did the hackers get in?
Co-chief executive Richard Teng said the attack involved a compromised laptop and malware designed to delete evidence.
Is this the biggest crypto hack ever?
Analysts believe it is the largest crypto heist in history, far above the 1.5 billion dollar Bybit theft in 2025.
What happened to the bitcoin price?
Bitcoin hit a six week low on 30 October, then recovered above 78,000 dollars on 2 November.
How much of the stolen crypto has been found?
Binance said about 3 billion dollars of affected assets had been located with industry partners as of 30 October.
What is TraderTraitor?
A North Korean hacking operation linked to the Lazarus Group that often poses as job recruiters to plant malware.
Why does North Korea steal crypto?
Analysts say cyber theft lets it raise billions despite sanctions, and the UN has linked proceeds to weapons programmes.
How many people use Binance?
Binance says it has 335 million registered users worldwide.
What should crypto users do after the hack?
Spread holdings across platforms, keep long term savings in cold storage and ignore unsolicited messages about the hack.
The Binance hack is the largest crypto theft on record, yet the exchange's speed in replacing 95 percent of the stolen assets kept a run from turning into a collapse. For Asia's crypto users, the takeaway is less about Binance than about concentration: no platform is immune, and only some can afford to make customers whole.
Talk to the SpinDepth deskYou've finished this story
Read on, send it to someone, or ask about it.
