Binance restores 95% of $6.3B stolen funds via SAFU and reserves
- The FBI and blockchain firms linked the attack to the North Korean hacking group TraderTraitor.
- Binance began restoring user withdrawals in phases on Sunday following the breach.
- The exchange used its own reserves and insurance funds to cover the stolen assets.
- US midterm elections are two days away with cost-of-living issues dominating the polls.
Binance, the world's largest cryptocurrency exchange by daily trading volume, reported a record theft of $6.3 billion in a cyberattack. The company announced it has replaced 95% of the stolen assets using its Secure Asset Fund for Users (SAFU), its Bitcoin reserve, its futures insurance fund, and its own company reserves.
Binance said the hackers used a "self-destruct mechanism" to hide their tracks during the breach. Following the asset replacement, the exchange began gradually resuming withdrawals for major cryptocurrencies including Bitcoin, Ethereum, BNB, XRP, Base, Doge, and Optimism as of 5 a.m. Eastern Time on Sunday.
FBI and blockchain firms link heist to North Korean hackers
The FBI formally attributed the $6.3 billion theft to the North Korean state-sponsored hacking group known as TraderTraitor on November 1, 2026. Blockchain analysis firms TRM Labs and Chainalysis both linked the attack to this group with high confidence. TRM Labs and Chainalysis further identified TraderTraitor as a hacking unit associated with the Lazarus Group.
Researchers noted that the group previously exploited employees and software providers to steal large sums. In response to these findings, the FBI urged cryptocurrency services to block transactions tied to specific addresses linked to the attackers. The FBI described the incident as the largest digital heist in history.
Binance uses reserve funds to cover customer losses
The exchange used these internal funds to purchase replacement cryptocurrency for the stolen assets.
The replacement capital originated from three distinct sources, including part of the $1 billion Secure Asset Fund for Users. Other sources included portions of the company's futures insurance fund and its own corporate reserves.
Binance co-CEO Richard Teng stated on X that the exchange has replenished 90% of the stolen assets. He committed to covering the remaining 10%, assuring users they will not bear the financial impact.
Sophisticated breach involved self-destruct mechanism and hot wallet access
Binance investigation revealed additional points of breach beyond the initial report that the incident stemmed from a compromised DevOps engineer's laptop.
Crypto markets face volatility as Binance resumes withdrawals
Prices of major cryptocurrencies fell sharply on Friday, according to CBS. At 8 am ET on Friday, Bitcoin was down 3.2% and Ethereum was down 3.8%, Africa Business Insider reported.
Binance suspended user withdrawals following the attack and began restoring them in phases starting Sunday morning. This first phase of withdrawals included Bitcoin, Ethereum, BNB, Solana, XRP, and Dogecoin. Africa Business Insider reported a net outflow of $3.64 billion in under 10 hours after the phased restoration began on November 1, 2026.
Binance worked with blockchain partners to freeze approximately $3 billion in assets related to the heist.
Binance cofounder Changpeng Zhao said that industry friends and competitors provided help after the hack. Coinbase CEO Brian Armstrong urged the industry to work together. Zhao asked Elon Musk to stop trolling after Musk commented on a post Zhao made regarding cybersecurity.
US midterm elections approach amid economic concerns
Democrats remain ahead of Republicans in national polls ahead of the US midterm elections, according to Aljazeera. The elections are two days away, with the cost-of-living crisis and the US-Israel war on Iran highlighted as key issues.
The president is described as very unpopular, while Americans feel pressure from high costs caused partly by tariffs and the war in Iran, Aljazeera reported.
Security incidents impact Cursor and Polymarket users
Polymarket temporarily paused trading on Thursday after users reported unauthorized withdrawals, but trading resumed by 3 pm ET, Africa Business Insider reported. The AI coding company Cursor, which is owned by SpaceX, reported that a security incident involving a "malicious version" of Claude Code impacted up to 5,000 users.
North Korea relies on cybercrime to fund state operations
The country’s most notorious cyberattack took place in 2014 against Sony Pictures over the film "The Interview," though it was not financially motivated.
Frequently Asked Questions
- Binance resumes withdrawals for some major cryptocurrencies after $6 billion heist - CBS News (cbsnews.com)
- Binance hack spotlights North Korea’s multibillion-dollar crypto theft operation - NBC News (nbcnews.com)
- Binance says hackers who stole a record $6.3 billion in crypto used a 'self-destruct mechanism' to hide their tracks - Business Insider Africa (africa.businessinsider.com)
- How North Korean hackers pulled off the largest crypto heist in history - Ynetnews (ynetnews.com)
- US midterms: 2 days to go – what polls say as Trump, El-Sayed hit the trail - Al Jazeera (aljazeera.com)
- As Midterms Approach, US Consumer Anxiety Is High — But Fashion Is Set to Rally - Vogue (vogue.com)
Add NewsPulse Time as a preferred source on Google