Binance Says 98% of Stolen Assets Replenished as FBI Blames North Korea for $6.3 Billion Attack

Binance says it has replenished nearly all of the token assets affected by the record-setting October 29 theft, even as federal investigators warn that the stolen funds are still moving through the crypto ecosystem.

The exchange’s report from Binance puts the impact at roughly $6.34 billion. Binance said 98% of the affected token assets had been replenished as of October 31, with company funds set aside to cover the remaining losses.

It also said approximately $2.85 billion had been frozen or intercepted with help from issuers, law enforcement and other industry partners.

The report says the affected assets included Bitcoin, XRP, Solana and Ethereum-related tokens, which made the recovery process uneven. Some token issuers could freeze funds directly, while native assets without an issuer had to be traced through exchanges, bridges and other on-chain services.

That distinction matters. Replenishing customers is not the same thing as recovering the stolen crypto.

Binance can make its internal balances whole while investigators and blockchain firms continue tracing assets that remain under an attacker’s control.

Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.

The company has already publicly committed to cover losses through… pic.twitter.com/UqtBd37Fpj

— Binance (@binance) October 30, 2026

Binance’s report describes a much more complicated intrusion than a single stolen private key. The company says the campaign involved fake recruiting approaches, malicious software downloads, compromised employee devices, access to an internal AI tool and, ultimately, a path into wallet-signing operations.

According to Binance, an attacker used a compromised computer and stolen credentials to deploy a container and trigger unauthorized withdrawals. The exchange said the attackers also abused Ethereum’s EIP-7702 authorization mechanism, allowing transactions to continue outside the normal withdrawal infrastructure even after regular withdrawals were suspended.

Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private… pic.twitter.com/5REncAI77y

— Binance (@binance) October 30, 2026

The on-chain damage reached several of crypto’s largest assets. Binance reported unauthorized transfers involving 233.46 million XRP, 18,270 Bitcoin, about 970,500 Solana and substantial Ethereum-related activity, among other assets.

Some stablecoins could be frozen by their issuers. Native assets such as Bitcoin and XRP do not have an issuer with the same ability to blacklist funds.

The FBI attributes the operation to North Korea and identifies the activity as TraderTraitor. The bureau said it had observed the actors converting stolen assets primarily into Ether before expected laundering through decentralized finance and instant-swap services.

Binance says it rebuilt affected systems, replaced devices, revoked credentials, tightened device and wallet-service controls and expanded behavioral anomaly detection. It also says an independent cybersecurity review is underway.

The immediate customer-loss question may be close to resolved if Binance’s replenishment figures hold up. The harder questions are still open: how much of the stolen crypto can actually be recovered, whether the exchange’s new controls close the full attack path, and what the incident means for custody systems across the industry.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.