FBI confirms North Korea stole $6.3 billion from Binance. It has paid back 90%

Update, 1 November: the FBI said on 31 October that North Korea was behind the hack, naming the Lazarus Group's TraderTraitor unit directly. Binance says it has now covered 90% of the $6.3 billion stolen, using its own company funds.

$6.3 billion.

That is the number most news reports carried on 30 October 2026 for a suspected hack at Binance, the world's biggest crypto exchange. Binance itself tells a smaller story. The exchange has only confirmed $2.54 billion in frozen funds, a figure that grew toward $3 billion within hours as investigators traced more of the money.

Both numbers come from real reporting. Neither one is final yet.

How much crypto did Binance really lose?

Nobody outside Binance knows for sure, and that gap is the real story here.

Al Jazeera's own report carries both figures in the same piece. Its headline calls the hack the "biggest crypto heist in history" at $6.3 billion, while the article explains Binance has only confirmed $2.54 billion frozen, a sum that climbed toward $3 billion as the hours passed. The blockchain analytics firm Chainalysis separately put the on-chain outflow near $5.9 billion. Other trackers cited by TechCrunch and Axios guessed anywhere from $2 billion to $5.7 billion drained from Binance's wallets.

Three different kinds of number are floating around at once. What actually left Binance's wallets, which is disputed. What got frozen before it could be cashed out, which is Binance's own figure. And what outside trackers guess the final damage will be. Treat $6.3 billion as what reports and blockchain trackers are estimating, not a number Binance has put its own name to.

How does this compare to crypto's biggest hacks ever?

Even the smallest number on the table beats every exchange hack before it.

Source: Al Jazeera, Global Banking & Finance factbox, Chainalysis, and news reports from the time of each hack. Mt. Gox and Coincheck amounts are valued at the prices of the day, not today's bitcoin price.

Read nextElvis Presley's rights owners are suing the AI company Anthropic over 274 songs

The previous record, Bybit's $1.5 billion loss, lasted barely 20 months before this one broke it.

What does Binance say actually happened?

One laptop may be behind billions in losses.

Binance's early investigation points to a single compromised laptop as the way in. It belonged to a DevOps engineer, the kind of staff member who keeps Binance's servers running day to day. Whoever controlled that laptop reached a service container, a walled-off slice of Binance's computer systems, and used it to send withdrawal requests nobody at Binance approved, according to the company's own early findings.

Binance first flagged the unusual activity on the evening of 29 October, US time. By 02:23 UTC on 30 October, less than six hours later, its investigators say they had already traced the breach back to that one laptop. Binance suspended deposits and withdrawals across several networks the moment it noticed, calling it a precaution while it worked out what had happened. The exchange says it has not confirmed any customer money was actually lost, only that unauthorized withdrawals went out while it investigated.

Who do investigators blame for the hack?

The same group blamed for crypto's last record-breaking theft.

Blockchain intelligence firm TRM Labs says it believes "with high confidence" that TraderTraitor, a hacking unit tied to North Korea's Lazarus Group, carried out the attack. Independent on-chain investigator ZachXBT reached the same conclusion separately. The FBI confirmed it on 31 October, naming TraderTraitor directly as the group behind the theft. The US Secret Service said it was "working around the clock" to identify, freeze, trace and recover the stolen funds.

Lazarus Group has been North Korea's state hacking unit for over a decade. It hit Sony Pictures in 2014 over a satirical film about North Korea's leader, and investigators blame it for the WannaCry ransomware that crippled hospitals and businesses in more than 150 countries in 2017. Since 2021, the group is believed to have stolen more than $5 billion in crypto alone, including the $625 million Ronin Network hack in 2022 and the $1.5 billion Bybit hack in February 2025 this new attack has now dwarfed. US officials say the stolen crypto helps fund North Korea's weapons programs.

This is not the only crypto trust story this month. Just weeks earlier, a Ledger reseller was caught selling hardware wallets with a hidden modem built in, and separate Ledger users found their wallets drained without warning. Around the same time, the US government moved over a billion dollars of seized Bitfinex bitcoin, reopening its own questions about who really controls crypto once it changes hands.

Will Binance pay back everyone who lost money?

Yes, say the people who run it, though nobody has finished counting yet.

Binance co-founder Changpeng Zhao, known as CZ, stepped back from running Binance.com years ago but remains a major shareholder. He wrote on 29 October: "I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered." Co-CEO Yi He said early the next morning that Binance would use its SAFU fund, plus company money, to cover every loss. SAFU stands for Secure Asset Fund for Users, an emergency pool Binance built years ago from a slice of its trading fees, kept aside for exactly this kind of day.

Trending nowLeon Lotz: The farmer the world won't believe

By 31 October, Binance said it had kept that promise for 90% of the $6.3 billion, setting aside more than $6.34 billion of its own company funds to replenish what was stolen. "Binance will absorb the financial impact of these stolen funds, not our users," the company said. The last 10% may take longer to source.

Photo: Aevozer / Wikimedia Commons, CC BY-SA 4.0

That promise has worked before, on a smaller scale. Binance covered a $570 million exploit in 2019 using the same fund. This is a far bigger test of it.

We are not telling anyone whether to buy, sell or hold any crypto. That choice is yours. What matters here is whether a company holding billions of other people's money can be trusted to protect it, and whether "we will cover it" means the same thing at $6 billion that it meant at half a billion.

Has Binance been in trouble before?

Yes, and not quietly.

In November 2023, Binance pleaded guilty in a US court to breaking money laundering laws. The exchange agreed to pay more than $4.3 billion in penalties, one of the largest corporate fines in US history. CZ pleaded guilty alongside it and paid $50 million of his own money, then stepped down as chief executive that same day. That is the real reason he now calls himself only a shareholder, not the man running Binance.com.

That history is why this hack carries extra weight. A company already fined billions for not knowing where customers' money came from is now asking those same customers to trust that it knows exactly where their money went during a hack. The $6.3 billion question is not really about computer code. It is about whether that trust still holds.

What happened to Bitcoin's price?

It fell fast, and it fell for everyone, not just Binance users.

Bitcoin dropped about 5% within hours of the news, sliding below $77,000. More than $1.5 billion in leveraged crypto bets were wiped out as the price moved, forcing traders out of positions they had borrowed money to hold. Anyone holding bitcoin felt this hack in their portfolio, even people who have never opened a Binance account, because the price of bitcoin moves for every holder at once, on every exchange.

Photo: Satheesh Sankaran / Wikimedia Commons, CC BY 2.0

Every past "final number" in crypto's worst hacks has grown with time, not shrunk. Mt. Gox's missing bitcoin was first reported far lower than the 850,000 coins investigators eventually counted, years after the exchange collapsed. If that pattern holds here too, $6.3 billion may not be the last number anyone hears about this hack.