Binance tries to recover $6.3 billion after largest cryptocurrency theft linked to North Korea

The largest cryptocurrency exchange, Binance, has reported a hack in which attackers gained access to $6.3 billion. The company has frozen about half of the funds and promises to cover all losses, while the FBI and the US Secret Service are investigating. Several analytics firms have linked the attack to North Korean hackers.

Otabek YusupovFirst published on tafs uz 30 October 2026 at 23:502 min read

The key facts

Binance has frozen about $3 billion of the $6.3 billion stolen in what is considered a record-breaking hack
The attack has been linked to the North Korean Lazarus group; the FBI and the US Secret Service are investigating
The company promises to cover all customer losses, but experts warn this promise may not be legally binding

Record-breaking hack and frozen funds

The world's largest cryptocurrency exchange, Binance, has reported a 'sophisticated' hack, in which attackers gained access to $6.3 billion (£4.7 billion) in digital assets. According to BBC News, this is believed to be the largest theft in the history of the crypto industry, exceeding the $1.5 billion Bybit exchange robbery in 2025. The company said it has frozen about half of the stolen funds — roughly $3 billion — but a significant portion of the assets remains with unidentified hackers. The US Secret Service said it is 'working around the clock'to identify, freeze, trace and recover the stolen funds, and Binance is also cooperating with the FBI.

How the attack happened

The company initially believed the hack began with a compromised DevOps engineer's laptop, through which unauthorized withdrawals were made. However, Binance co-CEO Richard Teng said the subsequent investigation revealed 'additional points of entry', and that the attack 'was not carried out by a single person.' According to him, the hackers used 'a self-destruct mechanism that destroyed tools and traces as they went,' which complicates the investigation. Analytics firm TRM Labs noted that elements of the attack resemble previous incidents linked to North Korea, including the Bybit hack, while Chainalysis said it has 'high confidence' in the involvement of North Korean hackers. Experts point to the notorious Lazarus group (also known as TraderTraitor), which is accused of working for the North Korean regime; Pyongyang denies this.

What this means for customers

Binance assures users: 'your money is safe, and we cover all losses'. The exchange initially suspended all deposits and withdrawals, but later said that 'deposits are unaffected'; its US arm, it says, was not affected, although some of the assets involved were Tether and Circle stablecoins pegged to the dollar. Meanwhile, as the BBC notes, a growing question in the industry and among users is whether Binance can actually cover such a loss: critics online compare these assurances to the promises made by FTX CEO Sam Bankman-Fried before the exchange's collapse in 2022. Several lawyers have warned that the promise to cover losses should not be considered legally binding: Daniel Tankel of the London firm Edwin Coe explained that the outcome will depend on 'what was promised to customers in the contracts' and where Binance can be sued for breach of obligations.