Binance Covers 90% of $6.3B North Korean Heist as FBI Confirms Lazarus Link

Key points

• Binance stated it has replaced 90% of the stolen assets, with the remaining 10% involving less liquid tokens that may take longer to acquire.
• The FBI confirmed that North Korea’s TraderTraitor group, linked to the Lazarus Group, was responsible for the theft of over $6 billion in virtual assets on or about October 29, 2026.
• Binance co-CEO Richard Teng confirmed the company is committed to covering the remaining 10% and that users will not bear the financial impact.
• The exchange used part of its $1 billion Secure Asset Fund for Users, its Futures Insurance Fund, and corporate treasury to cover the losses.
• The FBI observed that stolen assets were converted into Ethereum and urged private sector entities to block transactions with specific laundering addresses.
• Binance suspended withdrawals but is on track to resume them, while the attack involved a compromised laptop and malicious software designed to delete evidence.

Background

This incident follows a series of major cryptocurrency breaches in 2026, including a $1.5 billion theft from Bybit attributed to the same TraderTraitor group. The current hack is the largest in history, surpassing previous records and raising concerns about the security of digital assets and the potential impact of AI on cryptography.

How outlets are covering it

The Guardian and The New York Times both confirm the scale of the breach and Binance’s commitment to covering losses. The Guardian emphasizes the FBI’s official attribution to North Korea and the specific laundering tactics observed, while The New York Times highlights the internal response, noting that Binance executives formed an informal war room with about 100 participants to manage the crisis. Both sources agree on the timeline and the involvement of the TraderTraitor group, but The Guardian provides more detail on the FBI’s statement and the specific funds used by Binance to cover the losses.

Why it matters

The $6.3 billion hack is the largest cryptocurrency theft in history, highlighting the vulnerabilities of major exchanges and the capabilities of state-sponsored hacking groups. The FBI’s confirmation of North Korea’s involvement and the call for other firms to block laundering addresses indicate a coordinated response to mitigate the impact of the attack. The incident also raises concerns about the security of digital assets and the potential for future attacks, especially as AI capabilities expand.

What to watch

Binance is expected to resume withdrawals and cover the remaining 10% of the stolen assets. The FBI is likely to continue monitoring the laundering of stolen assets and may take further action against the TraderTraitor group. The incident may lead to increased security measures across the cryptocurrency industry and greater scrutiny of state-sponsored hacking activities.