Binance Says It Has Replaced 90% of Stolen Assets After $6.3 Billion Crypto Hack

Binance says it has already replaced 90% of the digital assets stolen in what the company and the FBI describe as the largest crypto hack on record. For PSPs, exchanges, and other virtual asset providers, the important part is not just the size of the loss, but the laundering pattern that followed: the attackers moved funds into Ethereum and then toward DeFi and instant swap services.

1. The breach hit Binance on Thursday, with hackers stealing $6.3 billion in digital assets. That puts it ahead of the previous record $1.5 billion Bybit hack in 2025, and well above earlier major incidents at Poly Network ($0.61B), Ronin Network ($0.54B), Coincheck ($0.53B), and MT Gox ($0.5B).
2. Binance Co-CEO Richard Teng described the incident as a highly complex attack. Investigators first traced it to a compromised engineer’s laptop, but the company later found additional breach points. Binance said the attackers used sophisticated malware with a self-destruct mechanism that deleted evidence and that more than one person was involved.
3. The market reaction was immediate: Bitcoin fell nearly 5%, Ethereum dropped nearly 6%, and Binance’s native BNB token slid by almost 10%. In other words, this was not just an exchange problem; it was a market event.
4. On Saturday, the FBI said a North Korea-affiliated group orchestrated the theft and identified the state-sponsored unit as TraderTraitor, which analysts say operates under the Lazarus Group. The FBI also linked North Korea to the 2025 Bybit hack, and said TraderTraitor is the name it uses for this cyber activity.
5. The FBI, together with the USSS and IRS-CI, said it has seen TraderTraitor actors converting the stolen assets primarily into Ethereum, then moving them through DeFi and instant swap services for further laundering. It also urged THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions to or from the listed addresses.

The FBI said it published a list of addresses tied to the laundering activity on October 31, 2026. For compliance teams and payment flows that touch virtual assets, that is the practical signal: once stolen funds start moving through swap layers, the screening question becomes whether your infrastructure can catch the addresses before they get out of sight.