Binance Covers 98% of $6.34B Hack Loss After North Korean Attack

Binance says it has replenished 98% of the digital assets affected by its October 29 security breach, after hackers linked to North Korea stole approximately $6.34 billion from exchange-controlled wallets.

The exchange published its initial investigation findings on November 3. They reveal that the attack was not a single incident or a simple phishing attempt. It involved months of preparation, fake job interviews, malicious software and compromised internal systems.

Binance has frozen or intercepted approximately $2.85 billion of the affected assets. It has also set aside more than 100% of the funds required to cover the losses, saying customers will not bear the financial impact.

The incident has raised wider questions about how companies protect employees, developer devices and the internal systems that control valuable digital assets.

A Five-Month Campaign Started With Malicious Software

According to Binance's investigation, the attackers began preparing as early as June 2026.

The first identified incident involved a Wallet DevOps engineer who downloaded a tampered Homebrew installer while trying to install a popular AI coding tool. Binance detected unusual activity, replaced the employee's device and rotated associated credentials.

However, the attackers had already obtained information about the engineer's role and colleagues working on wallet infrastructure.

The campaign continued in September, when another software engineer was approached through a legitimate job-hunting platform. The attackers posed as representatives of a fictitious company and arranged multiple interviews.

During the process, they shared personal social media accounts and other details to make the recruitment process appear genuine.

The engineer was eventually asked to download a code repository as part of a technical assignment. The repository contained malicious code that executed during setup, compromising the employee's work computer.

The attackers later used this access, alongside an internal Binance AI tool, to reach additional engineers' devices.

By October 29, they had obtained credentials and permissions that allowed them to reach systems involved in wallet operations.

How Hackers Drained $6.34 Billion

Binance said the attackers used compromised employee devices and stolen deployment credentials to trigger malicious activity in its wallet infrastructure.

The exchange reported that approximately $6.34 billion in digital assets were affected across multiple networks.

One important part of the attack involved Ethereum's EIP-7702 functionality. The attackers used malicious authorizations to delegate transaction execution rights from a Binance hot wallet to code they controlled.

This allowed them to move assets independently of Binance's normal withdrawal infrastructure.

Binance temporarily suspended withdrawals after detecting unusual transfers. However, the suspension could not immediately stop transactions that were already authorized onchain.

Related: Binance Hack: How Hackers Drained $6.3 Billion From the Crypto Exchange

The exchange said its hot wallet used multi-party computation (MPC), meaning there was no single private key that could simply revoke the malicious authorization. Its security team had to develop and execute a separate procedure to remove the delegation.

The final unauthorized transfer was completed at 23:56 UTC on October 29. Binance cleared the malicious authorization shortly afterward, at 00:10 UTC on October 30.

The incident shows why protecting private keys alone is not enough. Exchanges must also secure employee devices, internal permissions, software deployment systems and transaction authorization processes.

Binance Freezes $2.85 Billion and Replenishes 98% of Assets

Binance worked with blockchain networks, security firms and other industry participants to restrict the movement of stolen funds.

It reported that approximately $2.85 billion had been frozen or intercepted. This represents a substantial recovery effort, although it does not mean the entire amount has been returned to Binance.

The exchange also moved to cover the financial shortfall.

Binance said it had replenished 98% of the affected token assets by October 31. The remaining portion consisted largely of less liquid cryptocurrencies that were harder to acquire in the required quantities.

The recovery used several sources, including:

• Corporate treasury: Funds from Binance's own financial resources.
• SAFU: The Secure Asset Fund for Users, designed to protect customers during extreme incidents.
• Futures insurance reserves: A portion of the exchange's futures insurance fund.

Binance said it had set aside more than the full amount required to cover the affected assets. It also confirmed that the remaining tokens were being purchased through market and over-the-counter transactions.

The exchange's position is that customer balances will remain protected and users will not absorb the losses from the incident.

Deposits Begin to Outpace Withdrawals

The hack also created immediate pressure on Binance's customer confidence.

After withdrawals resumed in phases on November 1, users moved billions of dollars off the exchange. Early figures showed withdrawals significantly exceeding deposits.

However, the flow picture began to improve by November 3.

Binance reported that hourly deposits had started exceeding withdrawals. A separate 24-hour wallet-flow snapshot also showed positive net inflows.

That is an encouraging development, but it does not mean the earlier outflows have been fully reversed. Cumulative flows since withdrawals resumed remained negative, with withdrawals still exceeding deposits over the full period.

The distinction matters. A few hours of positive flows can indicate improving activity, but sustained deposits over a longer period would provide stronger evidence that confidence is returning.

Binance Strengthens Security After the Breach

Binance says it has already taken several steps to reduce the risk of another incident.

The exchange rebuilt affected wallet systems and its internal AI tool in new environments. It also replaced compromised devices, revoked credentials and tokens associated with affected employees, and expanded security scans across employee devices.

Additional measures include stricter device controls, enhanced wallet-service risk controls and expanded AI-based behavioural anomaly detection.

The company is also engaging independent security firms to review the incident. Some technical details will remain confidential to avoid giving potential attackers information that could help them exploit similar systems.

Binance said its security team had detected and prevented 57 suspected North Korea-linked cyber threat cases during 2026. The company described the incident as part of a wider threat environment targeting the cryptocurrency industry.

The FBI attributed the October 29 attack to North Korea. Binance cited the agency's finding in its report.

CZ Warns the Risk Goes Beyond Crypto

Binance founder Changpeng Zhao has warned that the incident highlights information-security risks that extend beyond cryptocurrency exchanges.

The attack relied on familiar corporate vulnerabilities: employee recruitment processes, compromised developer software, trusted internal tools and excessive access permissions.

These risks affect technology companies, financial institutions and organizations that rely on developers to manage critical infrastructure.

The use of an internal AI tool in the campaign also raises questions about how companies secure AI systems that can access sensitive information or interact with internal environments.

AI-based detection may help identify unusual behaviour, but it cannot replace access controls, device security and independent verification of sensitive operations.

What the Binance Hack Means for Exchange Security

Binance's recovery effort has addressed much of the immediate financial impact, but the incident is not yet fully resolved.

The remaining affected assets still need to be replenished, and the independent review may reveal additional weaknesses in the exchange's security architecture.

The positive deposit trend is another development to watch, although cumulative outflows show that confidence cannot be judged from a short period of improved activity alone.

More broadly, the attack demonstrates that a cryptocurrency exchange's security depends on much more than its wallet technology. Employees, devices, software tools and internal permissions can all become entry points.

Binance says it will absorb the losses and strengthen its systems. The longer-term test will be whether those changes prevent similar attacks and whether users continue to trust the exchange with their assets.