Binance covered 95% of the $6.3 billion crypto theft with its own money; the FBI blames North Korea
Binance reopened withdrawals on November 1 after using company money to replace 95% of the $6.3 billion stolen; the FBI attributes it to North Korea's TraderTraitor unit. The customer-protection fund was never the cushion; the corporate treasury was.
Richard Tang · 3 min read
The largest theft in crypto history did not end with the thieves; it ended on Binance's balance sheet. On November 1, 2026, the exchange reopened bitcoin withdrawals, the first network in a phased restart, after replacing 95% of the stolen tokens with company money 1.
The FBI attributed the theft to TraderTraitor, a North Korean state-sponsored hacking unit, in a October 31 alert issued with the Secret Service and IRS Criminal Investigation 23. Binance's 335 million registered users are being made whole by one treasury, and that fact now prices every platform that holds other people's crypto 23.
The break-in was a laptop; no blockchain failed
Co-CEO Richard Teng says the breach began with a compromised laptop and malware built to erase its traces 1. The drain itself, in blockchain-analytics firm Elliptic's on-chain analysis, needed no stolen key: a single Ethereum transaction carrying 50 pre-signed authorizations handed a Binance hot wallet to a sweeper contract that emptied it 3.
That is North Korea's method. TRM Labs' ledger shows almost nine-tenths of everything it has stolen came from attacks on the keys and signing systems behind wallets rather than bugs in code; every other hacker combined gets a fifth of their value that way 4.
One state is now most of the stolen market
TRM counts $12.8 billion taken by North Korea-linked hackers since 2017, and this year one state accounts for most of all crypto theft worldwide 4.
North Korea's share of everything hacked in crypto: 7% in 2020, 85% this year
Data
| North Korea's share of all crypto hack value | |
|---|---|
| 2020 | 7% |
| 2024 | 39% |
| 2025 | 63% |
| 2026 | 85% |
The freezable billions stopped; the rest escaped
Stablecoin issuers such as Tether and Circle froze nearly $2.7 billion within hours, because a stablecoin carries its issuer's freeze function; the Arbitrum Security Council acted too 4. The attacker still holds about $2.4 billion in ether and bitcoin, which no issuer can reach 4.
The laundering runs at software pace: Elliptic watched a Tron wallet push funds into the cross-chain swap protocol THORChain every hour for 31 straight hours, "moved by something that does not sleep" 5. The FBI's alert now asks swap services and node operators to block, not only exchanges 36. The one moment stolen funds can be stopped is the window between theft and conversion into native assets, and shortening that window is exactly what TRM sells 47.
The insurer of last resort was the exchange itself
Half of the $1 billion Secure Asset Fund for Users, the customer-protection reserve, went in; the futures insurance fund and the treasury paid the rest, with SAFU to be refilled and a full proof of reserves promised by November 3 18. The theft was more than six times that fund's entire size 14.
Most platforms could not write that check, and the market now knows which one can. For anyone holding or backing a crypto platform, reserve size and security spend have become valuation line items, and the analytics vendors that shorten the freeze window collect that spend; TRM's homepage sells an AI investigation platform for exactly this job 7. Watch which exchanges disclose reserve shortfalls next.
Customer funds turned out to be exactly as safe as the balance sheet behind them.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
