Binance starts returning stolen user funds after $6.34 billion hack

Binance says it has begun reimbursing users whose assets were stolen in the October 29 attack, setting aside more than $6.34 billion from its own balance sheet. For high-risk PSPs, the practical point is simple: this is what a large exchange does when hot-wallet losses, token liquidity, and reserves all hit at once.

1. According to Binance, $5 billion of the reserve is already held in the same tokens that were stolen, while the rest is being bought on the market and through OTC. The company says this may take time because some of the affected tokens have low liquidity. In the end, all user funds are supposed to be verified through Proof of Reserves.
2. TRM Labs estimates that over a few hours, about $6.36 billion was drained from Binance hot wallets across ten blockchains: roughly $3.8 billion in Ethereum, $1.47 billion in bitcoin, $628 million on Tron, and $296 million in XRP. That is about four times larger than the previous record, the $1.5 billion Bybit hack in February 2025.
3. Binance’s preliminary view is that the attacker gained access through a compromised company engineer’s laptop. TRM Labs says with high confidence that the attack is linked to the North Korean group TraderTraitor, which the FBI previously named as responsible for the Bybit hack. Binance says it will publish a detailed technical breakdown after the investigation is complete.
4. As a result of the attack, Binance suspended deposits and withdrawals. Tether, Circle, Ripple, and other issuers froze part of the stolen stablecoins, which Binance values at $3 billion, and is trying to recover together with partners and law enforcement. TRM Labs says about $2.4 billion remains beyond the issuers’ reach, mainly in ETH and BTC.
5. Bitcoin fell about 5% after the news and dropped below $77,000. Binance’s public line on the incident was: “We will weather this storm.”