The largest crypto theft on record hit Binance's hot wallets — and the exchange says customers will be made whole.
Binance estimated total impact at about $6.3 billion after suspicious outflows began on October 29, while TRM Labs put the figure at $6.36 billion and attributed the theft to North Korea's TraderTraitor group, citing a compromise of the exchange's hot-wallet signing infrastructure. Binance suspended deposits and withdrawals, which halted the outflows, and said it found no evidence of a private-key leak. By October 31 it said it had replaced about 90% of the affected assets using its Secure Asset Fund for Users (SAFU), part of its Futures insurance fund and corporate treasury, and that Bitcoin and Ether customer balances were fully backed. Reports differ on how much was frozen, with Binance citing $2.54 billion and other outlets about $3 billion, and the 90% figure measures replacement by Binance, not recovery from the attacker. The FBI said it is coordinating with partners, and no government had confirmed the North Korea attribution as of October 30. Binance has targeted November 1 to resume withdrawals, subject to security checks.
Customer coverage came from the exchange's own reserves rather than from any outside insurer or regulator, and the incident ranks above the roughly $1.5 billion Bybit theft attributed to North Korea in 2025.