Binance to reimburse users after multi‑billion hack; FBI blames North Korea

Binance, the world’s largest cryptocurrency exchange, said on October 30 that hackers stole more than $6 billion in what is now being treated as one of the largest crypto heists on record. The company announced it had set aside more than $6.34 billion from its own resources to cover the loss and that it has begun returning funds to affected users, while assuring customers that user assets are “safe” and that all losses will be reimbursed.

How the theft unfolded and the immediate response

Security analysts and company statements say roughly $3 billion of stolen funds have been frozen after Binance worked with blockchain partners to locate and immobilize tainted assets. Issuers of so‑called stablecoins — notably Tether (which issues USDt) and Circle (which issues USDC) — used their ability to freeze tokens on the blockchain and removed about $2.4 billion in stablecoins, roughly 40% of the total taken.

“This is the largest bank robbery in human history. What we are reporting is that North Korea managed to break through cybersecurity controls within Binance, the world's largest cryptocurrency exchange, which is by far the biggest cryptocurrency business — and thereby steal $6.36 billion. We observed funds beginning to be withdrawn from Binance, that is, from their digital wallet infrastructure. In fact, 'Binance' is like any other bank; it is, in effect, a blockchain bank,” said Ari Redbord, a cryptocurrency expert.

The FBI has publicly attributed the breach to North Korean actors and warned that the stolen funds are likely being converted, primarily into ether, and then laundered through DeFi tools and instant‑swap services as they are prepared for subsequent stages of laundering. “These funds are then expected to be further laundered by converting using DeFi and instant exchange services as they prepare them for subsequent stages of laundering,” the FBI said in a statement.

Experts note a pattern of North Korean cyber‑crime operations being used to finance weapons and other activities that have tangible consequences on battlefields. “It is believed that the attack was carried out by an elite state‑sponsored group known as TraderTraitor. All those names always sound very glamorous. However, I think that some of their operations involve posting fake job ads and manipulating people into downloading malicious software. As you know, the target in this case was a senior engineer who had access to a large number of high‑privilege accounts. What probably happened is that, during the job interview process, victims are often prompted to take a certain test, which actually turns into malicious software,” said Emily Taylor, Chief Executive Officer of SOT, Oxford Information Labs.

Taylor added that the incident highlights the need for rapid detection and response systems. “Part of the appeal of the crypto world is precisely that it does not operate like the traditional, highly regulated financial system. In this story there is also an interesting, I would say, technical aspect. It concerns a type of cryptocurrency called a stablecoin, which is much closer to traditional, properly backed and, so to speak, safer cryptocurrencies. That type of cryptocurrency could be stopped. But classic cryptocurrency, in its basic conception, is decentralized. It avoids central control and banking regulation. That's part of its appeal. But, of course, when something goes wrong, that means it is really difficult to restore the situation. There is no great authoritative institution that can simply reach into its pocket and say: 'Here, don't worry, everything will be fine',” she said.

The market reacted immediately: Bitcoin fell about 3.2% on Thursday evening and slid under $79,000. The theft follows an earlier major breach attributed to the same North Korean group: in early 2025 hackers reportedly stole roughly $1.5 billion from the exchange Bybit.

Photo: press material from the event