Binance has recovered 90% of assets stolen in record hacking attack

In the largest recorded cyberattack, over six billion dollars were withdrawn from the cryptocurrency exchange Binance. American agencies are working with private partners to assess the hack and recover the stolen funds, while Binance has promised to cover all losses.

The Federal Bureau of Investigation (FBI) is aware of the incident and is coordinating with partners to understand the scope of the activity, assess potential consequences, and organize appropriate investigative steps, as the agency stated in a message to Bloomberg News on Friday. A representative reported that FBI agents from the Secret Service are also collaborating around the clock with the private sector to recover the stolen assets.

The Department of Justice acknowledged receiving information about the attack, but representatives declined to comment on the progress of the investigation. Although the full details of the Binance hack have not yet been disclosed, this incident occurs amid growing concerns about the risks posed by hackers in the age of artificial intelligence.

Recent cyberattacks have affected the Polymarket prediction platform, South Korean financial companies Mirae Asset Global Investments Co. and Daishin Securities, as well as the Japanese currency trading platform GMO Internet Group Inc.

The largest cryptocurrency trading platform suspended withdrawals and committed to compensating for all losses. Binance co-founder Richard Teng stated in a video posted on social media on Friday that the exchange is capable of doing so due to continuous reinvestment of revenue into cryptocurrencies. Co-founder Yi He clarified that Binance's annual revenue would fully cover the lost amount. Withdrawals were expected to resume by Sunday.

Teng noted: 'Most of what we earn from daily operations is held in crypto assets. That is why we can immediately absorb a loss of this size using our own funds.'

Americans are prohibited from using this exchange; there is a separate, smaller entity, Binance.US.

This hack occurred during a period when the Trump administration and its regulators were actively promoting the widespread adoption of cryptocurrencies and blockchain technology. In September, the Securities and Exchange Commission approved a so-called innovation exemption that allows public company stocks to trade on blockchains. Experts believe that the Binance hack will likely intensify concerns among public company executives regarding the adoption of such technologies.

In turn, the Commodity Futures Trading Commission recently proposed regulations for digital asset markets and transactions. If approved, this measure will regulate leveraged futures trading offered to retail clients and create a new category for crypto exchanges offering such trades, requiring registration with the agency.

Austin Campbell, a cryptocurrency expert and former banker who is now an adjunct professor at NYU Stern School of Business, compared the situation to car safety, stating that 'transactions need delays and checkpoints.' He added: 'A car can be faster, cheaper, and more economical if you remove all the airbags and seatbelts.'

Blockchain analysis firms TRM Labs, Chainalysis, and Elliptic pointed to North Korea as the organization behind the theft from Binance. Chainalysis classified the incident as 'the largest in crypto history and one of the biggest financial crimes of all time.' The funds seized during the attack consisted of a mix of major cryptocurrencies, including Bitcoin, Ethereum, as well as dollar-backed stablecoins USDT and USDC.

Following the news of the attack on Binance, Bitcoin fell below $77,000 for the first time in over a month, remaining the largest traded currency near these low levels for most of Friday.

For cryptocurrency supporters who had enjoyed a two-month price recovery, the Binance incident overshadowed this rally.

Binance significantly surpasses its industry competitors, boasting assets worth approximately $135.2 billion compared to $28.6 billion held by the second-largest exchange, OKX, according to DefiLlama data.

Binance reported that the incident might be related to a compromised engineer's laptop, as well as 'additional points of entry.' The exchange stated that it found no evidence of leaked private keys.

In a post on X, Binance stated: 'It was a sophisticated attack, and we are doing everything possible in coordination with law enforcement to resolve it.'

In 2018, the exchange established an emergency insurance and reserve fund for users called the Secure Asset Fund for Users (SAFU), which serves as a guarantee for clients in 'extreme situations.' According to the exchange's report, SAFU is typically maintained at around $1 billion, but in 2024, it fluctuated in tandem with market movements.

The two largest stablecoin issuers announced measures to freeze the affected currencies. Paolo Ardoino, CEO of Tether, stated in an X post that he froze over $1.5 billion of USDT stablecoin 'related to the potential Binance exchange hack.' Jeremy Allaire, managing director of Circle Internet Group Inc., stated that $800 million of his USDC token was frozen amid 'reports of a possible exploit related to Binance.'

Binance, considered the largest global platform for cryptocurrency trading, was the victim of a hacker intrusion that resulted in the theft of $6.3 billion (equivalent to R$ 33.9 billion in direct conversion) in assets held in its users' wallets. This incident is cited as the largest cyberattack ever documented involving cryptoassets, although investigations must confirm this claim.

If confirmed as the largest attack, the event at Binance would surpass the $1.5 billion loss suffered by Bybit in February 2025, an attack linked to the North Korean hacker group known as TraderTraitor.

In response to the incident, Binance announced that it will assume full responsibility for the damage caused by the attack, as disclosed in its post on the X platform. However, the company had to temporarily suspend withdrawal and deposit processes (although the latter have since been reactivated) while analyzing its systems and investigating the situation.

The cyberattack began on October 29, 2026, with most of the fraudulent transfers occurring within a twenty-minute period, despite other movements being registered in the subsequent hours.

Preliminary analysis conducted by Binance suggests that the intruders gained access to a DevOps engineer's laptop. Using this computer, the hackers allegedly managed to penetrate Binance's internal systems by leveraging the engineer's access privileges. This allowed them to execute cryptocurrency transfer transactions using the company's own system authorizations, without needing to violate or capture cryptographic keys.

Binance also communicated that it has identified other potential vulnerabilities in its systems, indicating that the engineer's laptop may have been only one of the vectors used in the attack.

According to the initial investigation conducted by the digital security firm TRM Labs, the hacker group TraderTraitor reappears as the probable perpetrator of this action.

The total amount of the loss was not higher because a significant portion of the stolen cryptoassets consisted of stablecoins, which are digital currencies pegged to the value of fiat currencies and issued by corporations capable of blocking these assets in digital wallets.

In this specific case, Tether, the issuer of the USDT stablecoin, blocked assets totaling $1.77 billion. Concurrently, Circle, responsible for USDC, froze an equivalent amount of $825 million. Furthermore, other entities, such as Ripple, also participated in the blocks.

However, cryptocurrencies like Bitcoin and Ether do not have the same blocking mechanisms, which led the intruders to attempt to convert part of the stolen stablecoins into unprotected cryptoassets. The swift actions taken by Tether, Circle, and other companies helped contain these operations.

Despite this, a considerable volume of cryptocurrencies was captured by the intruders. CEO Richard Teng and co-founder Changpeng Zhao assured that Binance will fully cover the $6.3 billion lost, using its own funds and a guarantee fund called SAFU (Secure Asset Fund for Users).

Affected customers should await further instructions provided by Binance itself.

Hackers stole $6.3 billion (equivalent to approximately 33.71 billion Brazilian reais) from Binance, the world's largest cryptocurrency exchange. Analysts consider this incident the largest in the sector's history.

This incident caused a market drop, prompted industry companies to freeze some funds, and raised questions about the security of digital asset trading platforms.

According to the American blockchain analytics company TRM Labs, the attackers gained access to Binance wallets across 10 different networks and transferred the majority of the funds in about 20 minutes. The company linked this attack to North Korean groups, noting technical similarities with previous thefts attributed to Pyongyang, including the 2025 hack of the Bybit exchange, which was investigated by the FBI.

Chainalysis reported that it could not yet confirm the cause of the intrusion. By 9:30 AM Brazilian time, the company had identified at least $5.912 billion (approximately 31.63 billion Brazilian reais) in stolen assets.

Mark Karpeles, former head of the Mt. Gox exchange, told Reuters that Binance's assets appear to be distributed across different systems. He speculated that the hacker might have obtained valid authorization to move funds in certain platform systems and possibly even access to a private key.

Binance cooperated with partners to block the affected resources and managed to localize about $3 billion (16.05 billion Brazilian reais). Co-founder Yi He confirmed that the company would cover all losses resulting from the attack.

Other companies also participated in efforts to prevent the movement of funds. Binance's initial investigation showed that the breach might have started with the compromise of one engineer's computer. This access allowed the attacker to penetrate one of the exchange's systems and execute unauthorized withdrawals.

The company stated that user deposits were unaffected and expected to resume withdrawals within 48 hours after the attack. Binance also holds a customer protection fund composed entirely of Bitcoin.

For Kenneth Goh, Director of Private Capital Management at UOB Kay Hian, the attack on one of the world's largest exchanges should prompt investors to pay more attention to asset custody and platform responsibility in case of security failures.

The market reacted to the incident with decreased trading. Bitcoin fell by more than 3%, reaching a six-week low of $76,368. Ethereum also lost over 3%, dropping to $2,178. Coinbase shares fell by 4.8%, and Strategy shares dropped nearly 6% in extended trading in the United States.

Amanda He, Investment Director at ChainUp Investment, told Reuters that the initial drop might have been caused by the cryptocurrency being sold by the attacker himself. In her opinion, this step contributed to spreading investor concerns during the Asian session. She mentioned that her company sold positions held on Binance and converted the proceeds into stablecoins.

For Tim Sun, Senior Researcher at HashKey Group, the pause in deposits and withdrawals on Binance could negatively affect capital flow between platforms and impact market makers responsible for providing buy and sell prices to facilitate trades.

Liquidity concerns are also featured in assessments by Damon Xu, founder of 1Token. Commenting to Reuters, he predicted a reduction in strategies involving simultaneous operations across different exchanges and the use of leverage, which allows trading with borrowed funds. Xu believes that decentralized platforms may benefit from potential capital and commercial activity shifts.

Jeff Ko, Lead Analyst at ViaBTC, assessed to Reuters that Bitcoin might face less selling pressure because its transactions are tracked on the blockchain, making it difficult to move stolen funds without leaving traces. Ethereum, conversely, might experience greater pressure due to the availability of tools that facilitate obscuring transaction origins.