31-10-2026
Binance says it has replenished 90% of the $6.3bn in cryptocurrency stolen in Thursday’s hack, which it describes as the largest crypto theft on record. The exchange says the remaining 10% may take longer to source in the required amounts, but has pledged to cover all losses using company funds. It said it had set aside more than $6.34bn and that users would not bear the financial impact. The company says its reserves cover bitcoin, ethereum, Tether and seven other widely traded crypto assets.
The FBI attributed the hack to North Korea. Two analytics firms had earlier told the BBC that intelligence pointed to the Lazarus Group, also known as TraderTraitor, a state-backed hacking unit named by the FBI. North Korea has denied involvement in such attacks. Binance said its investigation first suggested an engineer’s compromised laptop enabled unauthorised withdrawals, but later uncovered additional points of breach. Co-chief executive Richard Teng said more than one person was involved and that the hackers used sophisticated techniques, including a self-destruct mechanism to conceal their tracks.
Binance said it froze around $3bn of stolen assets with help from law enforcement, intelligence firms and other partners. The US Secret Service also said it was working with private-sector partners to identify, freeze, trace and recover the funds. The investigation is ongoing. Binance’s immediate next step is to resume user withdrawals; it said it expected to reopen them on Sunday 1 November and would confirm details in a further update.
The reported theft exceeds the previous record, the $1.5bn stolen from the Bybit exchange in 2025, which the FBI also attributed to North Korea. Founded in China in 2017, Binance is the world’s largest cryptocurrency exchange and is estimated to serve hundreds of millions of users globally.
Entities: Binance, Richard Teng, Federal Bureau of Investigation (FBI), US Secret Service, North Korea • Tone: analytical • Sentiment: neutral • Intent: inform
31-10-2026
Two blockchain analytics firms, TRM Labs and Chainalysis, say they have strong evidence that the Lazarus Group, a North Korean state-backed hacking unit also known as TraderTraitor, was likely behind the $6.3bn theft from Binance, the world’s largest cryptocurrency exchange. The suspected attack adds to a series of major cybercrimes attributed to North Korea, which experts say uses hacking and cryptocurrency theft to generate funds, although Pyongyang has denied such accusations.
The article places the incident in the context of earlier alleged North Korean operations. These include the 2014 Sony Pictures hack, which exposed executives’ emails, and the $1.5bn theft from the Bybit exchange, for which the FBI blamed North Korea last year. The FBI said TraderTraitor moved quickly to launder and disperse the Bybit assets, converting them into Bitcoin and other digital currencies with the aim of turning them into cash. North Korean cyber operations are described as systematic, with talented students reportedly recruited into groups overseen by the country’s intelligence agency. Some activity is believed to take place in China, near North Korea’s border.
In the Binance incident, attackers are accused of exploiting a special authorisation to redirect funds from an internet-connected hot wallet. TRM Labs said the attacker likely accessed Binance’s hot-wallet signing system. Binance first suggested that an engineer’s laptop had been compromised, but later said its investigation found additional points of breach. Co-CEO Richard Teng acknowledged those findings. The company said about 80% of the stolen assets had been secured, while the remainder was still unaccounted for.
The article says the scale of the heist illustrates the growing capability of suspected North Korean hackers. Experts also point to artificial intelligence as a potential aid to cybercrime, though its use in this attack remains uncertain. Chainalysis said the laundering patterns were unlike those it had previously observed.
Entities: Lazarus Group, TraderTraitor, North Korea, Kim Jong Un, Binance • Tone: analytical • Sentiment: negative • Intent: inform
31-10-2026
Binance says it has replaced 90 per cent of the cryptocurrency stolen in a reported $6.3-billion US hack, using company funds to buy replacement tokens. The exchange said the remaining 10 per cent involves less-liquid tokens that could take longer to obtain, and co-CEO Richard Teng pledged that Binance would cover the outstanding amount so users would not bear the financial impact. Binance set aside about $6.34 billion in company funds for the losses, drawing on its Secure Asset Fund for Users (SAFU), its Futures Insurance Fund and corporate treasury.
The FBI attributed the attack to TraderTraitor, a North Korean state-sponsored unit. It said members of the group were seen converting stolen assets into ethereum and warned that further laundering through related technology was expected. Binance described the breach as a complex attack involving a compromised laptop and malicious software designed to erase evidence, complicating efforts to trace and investigate the theft.
The incident unsettled crypto markets: prices fell on Friday as Binance sought to reassure customers. The exchange said deposits were unaffected, but withdrawals were suspended after the breach. It expected to resume them on Sunday and said it would cover all losses.
Binance also reported taking a new snapshot of assets on its platform for its proof-of-reserves process. It said users holding 10 specified tokens would be able to verify that their assets were backed at a minimum 1:1 ratio once the full proof became available. The article presents Binance’s recovery and customer-protection claims alongside the FBI’s attribution and laundering warning.
Entities: Binance, Richard Teng, Federal Bureau of Investigation (FBI), TraderTraitor, North Korea • Tone: analytical • Sentiment: negative • Intent: inform
31-10-2026
Binance says it is working with law enforcement, stablecoin issuers, blockchain intelligence firms and other industry partners to recover assets stolen in a $6.3 billion cyberattack. The exchange has also pledged to cover users’ losses with company funds. Experts attribute the attack to TraderTraitor, a hacking unit linked to North Korea, and say the breach involved Binance’s internet-connected “hot wallets.” Binance reported that the operation took about 20 minutes; its initial investigation pointed to a compromised laptop, while a later probe found additional points of breach.
The recovery effort began quickly. According to TRM Labs, Circle and Tether froze $2.4 billion in assets within an hour, and Ripple and World Liberty Financial also froze funds. Binance said a total of $3 billion in crypto assets had been frozen. But roughly $2.4 billion in bitcoin and ether cannot be frozen by issuers because those assets move on public blockchains. Experts say recovery may depend on the hackers trying to convert the funds into conventional currency, where law enforcement and financial intermediaries could intervene.
Frozen assets still must be transferred to secure wallets, formally seized through legal process and addressed in civil forfeiture proceedings before they can be permanently returned to victims or the government. Meanwhile, the attackers may be laundering the funds to evade detection. Roman Bieda of Recoveris warned that North Korea has previously used stolen cryptocurrency to circumvent sanctions and fund its activities. The article notes that TraderTraitor was also linked to a 2025 Bybit attack that caused a $1.5 billion loss. The timeline for recovering Binance’s funds remains uncertain: one recovery handled by Bieda’s team took 14 months, and success depends on coordination and contacting relevant parties before assets move again.
Entities: Binance, Ari Redbord, TRM Labs, TraderTraitor, North Korea • Tone: analytical • Sentiment: negative • Intent: inform
31-10-2026
Two security incidents affecting cryptocurrency platforms have renewed questions about whether users should keep funds on exchanges. A Thursday incident at Binance affected about $6.3 billion in client assets, which the article describes as the largest crypto theft on record. On the same day, prediction market Polymarket temporarily halted trading on its international exchange after a third-party data provider was hacked, with at least $2.7 million drained from users’ wallets.
Experts interviewed by CNBC disagree about what users should do. University of Tulsa professor Tyler Moore urged caution, pointing out that cryptocurrency exchange deposits lack protections comparable to the Federal Deposit Insurance Corporation’s coverage of bank deposits. In contrast, Blockaid CEO Ido Ben-Natan said Binance and Polymarket had pledged to reimburse affected users, and argued that exchange backing may make platforms preferable to self-custody. He expects further attacks as artificial intelligence changes cybersecurity, but believes the industry’s experience responding to breaches could ultimately improve security.
The article notes that the incidents involved offshore platforms, while Binance’s regulated U.S. exchange, Polymarket’s domestic exchange, Coinbase, and Robinhood were not affected. Commodity Futures Trading Commission Chairman Michael Selig said offshore exchanges lack safeguards found in U.S. financial markets and proposed that exchanges register with the CFTC. However, University of Pennsylvania professor Brett Falk cautioned that regulation may not prevent a breach stemming from a compromised employee laptop or weaknesses in the software used to authenticate users. Binance later reported additional breach points without specifying them.
Experts also differ on whether exchange custody is safer than holding assets in a personal wallet. Some say a company can cover losses that self-custody cannot, while Global Settlement Network CEO Ryan Kirkley warned that assets are not truly safe without insurance from a reputable broker-dealer. Overall, the article presents the risks as unresolved, with more incidents likely and no universally accepted protection for crypto assets.
Entities: Binance, Polymarket, Polygon blockchain, Tyler Moore, University of Tulsa • Tone: analytical • Sentiment: neutral • Intent: analyze
31-10-2026
Binance says it has restored backing for about 90% of the roughly $6.3 billion in token assets stolen from its hot wallets in what it describes as a record crypto theft. The exchange cautioned that restoring backing is not the same as recovering the assets from the attacker. It plans to buy the remaining tokens through market and over-the-counter channels, with the outstanding amount largely consisting of less-liquid tokens outside its top 10. Binance says Bitcoin, Ether, several stablecoins, and other major tokens are now fully backed. It will absorb the financial impact rather than pass the losses on to users, drawing on its Secure Asset Fund for Users, part of its Futures insurance fund, and its corporate treasury.
The exchange said its next milestone is to resume withdrawals by Sunday, subject to security checks and final confirmation. It is continuing to investigate the attack and declined to provide CNBC with additional details. The cause remains unclear: Binance initially suggested a compromised DevOps engineer’s laptop may have enabled unauthorized withdrawals, but Co-CEO Richard Teng later described a more complex process than the misuse of one employee’s permissions.
Separately, the FBI said it had determined North Korea was responsible. The agency said North Korean actors laundered the stolen assets by converting them into Ethereum and are expected to convert digital assets further as they prepare them for additional laundering stages. Blockchain intelligence company TRM Labs had also pointed to North Korean hackers, citing similarities to earlier North Korea-linked thefts, including the Bybit and KelpDAO hacks. The cited similarities included small Tornado Cash withdrawals used to fund an operator wallet, preparations beginning well before the theft, and signatures obtained in advance and executed together.
Entities: Binance, Federal Bureau of Investigation (FBI), North Korea, Richard Teng, TRM Labs • Tone: analytical • Sentiment: neutral • Intent: inform
31-10-2026
France 24 reports that Binance executives are trying to recover billions of dollars after the cryptocurrency platform suffered a reported theft of $6.3 billion from users. The article describes the incident as the biggest heist in cryptocurrency history, while making clear that the amount and attribution are reported rather than independently established in the brief report. Analysts reportedly suspect North Korea was behind the attack. If the reported figure is accurate, the theft would greatly exceed the previous record cited in the article: the $1.5 billion stolen from crypto exchange Bybit in February 2025. The report offers no further details about how the breach occurred, which assets were taken, how many users were affected, or what recovery measures Binance is pursuing. Its central focus is the extraordinary reported scale of the loss and the effort by Binance executives to recover the funds. The North Korea attribution is presented as analysts’ assessment, not as a confirmed finding. The comparison with Bybit places the incident in the context of earlier large-scale cryptocurrency thefts and underscores how much larger the reported Binance loss would be.
Entities: Binance, Bybit, North Korea, cryptocurrency, crypto theft • Tone: urgent • Sentiment: negative • Intent: inform
31-10-2026
After a record US$6.3 billion hack of Binance, cryptocurrency exchanges moved to strengthen their defences and called for faster information-sharing across the industry. Coinbase said it adjusted systems that store cryptocurrency keys offline as a precaution, while Kraken said it was monitoring incidents and looking for vulnerabilities. The breach has heightened concern because digital assets are becoming more integrated into mainstream finance amid US regulators’ efforts to promote that integration. Industry figures, including Franklin Templeton’s Chris Perkins, said security needs immediate attention.
Binance halted withdrawals after the Oct 29 attack and said it would cover losses with company funds. Co-chief executive Richard Teng said the attack may have started with a software engineer’s compromised laptop, giving hackers access to systems used to process withdrawals. Further breaches were discovered, and software that erased traces complicated the investigation. Analysts at TRM Labs and Chainalysis said the theft’s rapid execution and laundering patterns resembled North Korean-linked attacks, although the attribution remains uncertain and North Korea denies involvement.
Executives expressed confidence that Binance could absorb the losses and that the incident would not cause wider financial damage. Bitcoin and ether fell sharply on Oct 29, then recovered some of their losses the following day. Experts said social engineering may have helped compromise the laptop, prompting companies to plan more employee training. Stablecoin issuers Tether and Circle said they had frozen funds linked to the incident, but bitcoin and ether cannot be frozen by a single entity. Chainalysis described the apparent laundering methods as unusually sophisticated.
Some exchange leaders proposed a coordinated, real-time system to alert participants to hacks, share information and help freeze suspected stolen funds quickly. GSR’s Josh Riezman said the incident could spur improvements as traditional finance and digital assets increasingly converge.
Entities: Binance, Coinbase, Kraken, Donald Trump, Chris Perkins • Tone: analytical • Sentiment: neutral • Intent: inform
31-10-2026
Binance says it has covered 90 per cent of the estimated $6.3 billion stolen in a hack described as the largest cryptocurrency theft on record. The exchange plans to draw on three sources to replace the missing assets: a partial deployment of its Secure Asset Fund for Users (SAFU), part of its Futures insurance fund, and Binance’s corporate treasury. Binance said users could check online balances for the first two funds.
The remaining 10 per cent is made up of less liquid tokens, which may take longer to obtain in the necessary quantities. The company expects to resume user withdrawal services on November 1, though it said further details would be confirmed later.
The theft began at about 12:24 a.m. UAE time on October 30, when funds started leaving Binance’s internet-connected hot wallets, used to process customer withdrawals. According to Etherscan data, one transaction transferred about 167,464 Ether, then worth roughly $388 million, along with 63 other tokens, to an address created only hours earlier. That address had been funded through the Tornado Cash mixing service.
The estimated loss exceeds the $1.5 billion stolen from Bybit in February 2025. The article also reports that Bitcoin’s price fell after news of the hack and stood at about $76,450, citing CoinMarketCap. Binance’s update describes its efforts to cover the losses, while the status of the remaining tokens and the precise timing of resumed withdrawals were still unresolved.
Entities: Binance, Binance Holdings, Secure Asset Fund for Users (SAFU), Futures insurance fund, Tornado Cash • Tone: analytical • Sentiment: negative • Intent: inform
31-10-2026
The $6.3 billion breach of Binance’s systems has shaken cryptocurrency markets and renewed questions about exchange security, investor confidence and regulation. Binance said its systems were compromised, and deposits and withdrawals remained suspended. Bitcoin fell to about $76,400 after news of the incident. Binance co-chief executive Yi He pledged that the exchange would cover all losses, but analysts say confidence will depend on how quickly the breach is contained, services are safely restored and the company provides transparent disclosures.
Commentators warn that customers and trading desks are especially concerned about access to their assets and the ability to move collateral or manage positions while the platform is frozen. Whether the incident becomes a lasting crisis, they say, depends on keeping losses contained, reimbursing customers and resuming withdrawals. Broader effects on equity markets may be limited, depending on financial exposures and market conditions, though crypto-linked businesses could feel the impact.
Institutional investors are expected to reassess custody arrangements, counterparty risk and how much capital they hold on exchanges. Some experts believe investors will distinguish a platform’s operational security failure from a failure of cryptocurrency or its underlying technology, and do not expect adoption to reverse. However, due diligence may increasingly focus on resilience and recovery, not just prevention.
Regulators are likely to examine withdrawal controls, supplier access, reserves, custody practices and exchanges’ capacity to absorb losses and maintain operations. The UAE’s Financial Services Regulatory Authority said it was engaging closely with Binance and monitoring the incident. The article notes that regulatory licensing and cybersecurity frameworks cannot guarantee users will avoid losses; their effectiveness will be tested by how well safeguards operate under pressure and protect clients. The breach also raises questions about law enforcement, litigation to recover assets and preventing stolen funds from moving through the industry.
Entities: Binance, Yi He, Kokila Alagh, Julien Olivier, Vincent Chok • Tone: analytical • Sentiment: negative • Intent: analyze
