Binance has bought back most stolen tokens from company reserves, and about $3 billion is frozen
Binance has replaced 90% of the $6.3 billion stolen in the Binance hack, and the FBI blames North Korea. TF is tracking the updates. Binance is covering user losses with company funds, and the stolen coins are out of reach in the near term.
What’s Happening & Why It Matters
FBI Names TraderTraitor
The FBI says North Korea carried out the theft, dated to or about 29 October 2026. The bureau links the attack to TraderTraitor, a group believed to belong to the Lazarus Group. The FBI blames the group for the $1.5 billion (about €1.3 billion) theft from Bybit in February 2025.
The bureau says the attackers are converting stolen assets into ether and expects laundering through decentralised finance and swap services. Private firms should block transactions linked to the addresses involved. North Korea has denied involvement, according to Daily Hodl.
Binance Replaces 90% of Losses
Binance (@binance) set aside more than $6.34 billion (about €5.6 billion) of company funds. The money came from its $1 billion SAFU reserve, a futures insurance fund and its corporate treasury. Binance used the funds to buy tokens covering about 90% of the stolen amount.
The last 10% is in less liquid tokens outside the top ten, so purchases take longer. Binance says holdings of BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are backed in full. Co-chief executive Richard Teng says users will not bear the loss.
About $3 Billion Frozen, Withdrawals Return
Binance says about $3 billion (about €2.7 billion) of the stolen assets is frozen. Law enforcement and industry partners helped. Frozen funds are not returned yet, and Binance has not said how much Binance expects to recoup. Withdrawals reopen in phases from Sunday 1 November, after a proof-of-reserves snapshot on 31 October.
Early findings pointed to a compromised engineer’s laptop, as TF covered in its 30 October cybercrime round-up. Teng calls the incident a complex attack with additional points of breach. Several people took part, and the malware included a mechanism to delete evidence. Attackers compromised the hot wallets at about 20:05 UTC on 29 October.
Markets Take the Blow
News of the theft on 30 October cut bitcoin by 5% and ether by 6%. BNB, Binance’s token, fell 10%. Binance’s response shields users, but the exchange absorbs a loss larger than most rivals’ reserves.
My take: Binance acted fast to protect customers, a bigger priority for the exchange than the headline loss. The FBI attribution makes full recovery improbable, because North Korean laundering is fast. Freezes by Tether, Circle and others are the best hope for returning funds.
TF Summary: What’s Next
Binance will publish a post-mortem and finish buying the last 10% of tokens. Regulators will question exchange security and hot wallet limits. Investigators will trace laundering routes through decentralised finance and instant swap services.
MY FORECAST: Withdrawals will return in full within a week. Binance will return no more than a fraction of the $3 billion frozen before 2027. Rival exchanges will tighten hot wallet limits.
Stories You May Like
- TF Cybercrime Round-up: 30 October 2026
- TF Cybercrime Round-up: 6–11 October 2026
- OpenAI Models Hacked Test Crypto Wallet Websites
- Nvidia’s Jensen Huang Met Suspected Chinese Spy, Times Says
- Google Unveils Gemini 4 Carbon, a Vulnerability-Hunting Model Few Can Use