Binance Arranges $6.34 Billion to Cover Biggest Crypto Hack Ever as North Korea Blamed

The world’s largest cryptocurrency exchange is fighting the biggest battle in its history. Binance has arranged more than $6.34 billion in company resources to cover customer losses after attackers drained an estimated $6.3 billion from its wallets late on Thursday, 29 October — a theft blockchain investigators are calling the largest cryptocurrency heist ever recorded.

The exchange says roughly $3 billion of the stolen assets have already been frozen with the help of industry partners, and it has pledged that no customer will be left out of pocket. Withdrawals remain paused while security checks continue, though Binance has indicated they could resume within days.

The attack: $6.3 billion gone in about 20 minutes

According to blockchain analysis firms, the attacker moved funds out of Binance’s hot wallets across ten different blockchains in a burst that lasted roughly 20 minutes, starting at about 20:05 UTC on Thursday. The stolen assets included bitcoin, ether and the stablecoins USDT and USDC, along with smaller tokens.

Binance’s preliminary investigation pointed to a compromised DevOps engineer’s laptop, which allegedly allowed the attackers to submit unauthorised withdrawal requests through the company’s internal systems. The exchange said it found no evidence that wallet private keys were leaked. The full attack path, however, remains under investigation.

To put the scale in perspective: the theft is roughly four times the $1.5 billion stolen from the Bybit exchange in February 2025, the previous record. Blockchain analytics platform DefiLlama has logged 322 confirmed crypto incidents so far in 2026, with total losses exceeding $8.7 billion.

Binance’s answer: a $6.34 billion promise

In an update shared with CoinDesk on Friday, Binance said it had set aside more than $6.34 billion to restore customer balances, with $5 billion already held in the exact token assets that were affected. The company is drawing on its Secure Asset Fund for Users — an emergency insurance reserve that typically holds around $1 billion — alongside general company funds.

“We will continue to use company resources to cover confirmed shortfall… Ultimately, all user funds will be verified publicly through our Proof of Reserves. We will weather this storm,” the exchange said.

Binance kept deposits open but paused withdrawals while it completes security checks. It said withdrawals could begin resuming roughly 45–48 hours after its Friday morning update — meaning early next week — though it has not given a precise timetable. Binance.US said it was not affected by the exploit.

The fightback: $3 billion frozen on-chain

While the theft was enormous, the response from the crypto industry has been unusually fast. Binance says partners have frozen about $3 billion in affected assets, separate from its own reserves. Stablecoin issuers did the heavy lifting: Tether CEO Paolo Ardoino said his firm froze about $1.6 billion linked to the hack, while Circle CEO Jeremy Allaire said the company froze more than $800 million.

World Liberty Financial froze $27 million of its USD1 stablecoin, and the Arbitrum network’s Security Council intervened on its own network. The totals reflect different snapshots — TRM Labs counted about $2.7 billion frozen as of 00:30 UTC on 30 October, while Binance later reported around $3 billion.

There is an important caveat: freezing assets does not immediately return them. TRM’s global head of policy, Ari Redbord, noted that recovery requires a separate legal process, potentially involving court orders and coordination with token issuers — a process that can take months or even years. The attacker has also converted some of the stolen stablecoins into bitcoin and ether, which are harder for issuers to block.

North Korea’s TraderTraitor blamed

Two of the industry’s leading blockchain intelligence firms have pointed the finger at the same suspect. TRM Labs attributed the attack with “high confidence” to TraderTraitor, a North Korean state-backed hacking unit, citing the operation’s sophistication and speed. Chainalysis reached the same conclusion. The FBI previously named the same group as responsible for the $1.5 billion Bybit theft in February 2025.

Binance itself has not publicly named an attacker, and its investigation continues. TRM estimates that the attacker still holds more than 420,000 ETH and 18,270 BTC — worth roughly $2.4 billion at recent prices. One analyst called it “the largest bank heist in human history.”

What it means for Pakistani crypto users

The hack lands at a sensitive moment for Pakistan’s own crypto journey. Just this week, the government formally made its new crypto regulator, the Pakistan Virtual Assets Regulatory Authority (PVARA), the anti-money-laundering supervisor for virtual asset businesses — putting crypto oversight on the same legal footing as banks.

For Pakistani users holding funds on Binance, the exchange’s pledge to cover all losses from its own resources is the key reassurance. Users should keep an eye on Binance’s official announcements for the withdrawal resumption timeline and avoid acting on rumours circulating on social media, where scammers frequently exploit high-profile hacks with fake “refund” schemes.

Sources: CoinDesk, Tech Xplore.