The attack occurred on the night of October 30. According to preliminary findings from Binance’s internal investigation, the attackers gained access to the personal laptop of one of the company’s engineers, and through it to an internal system that allowed transactions to be carried out. At the same time, the exchange found no signs of compromise of the private keys of cryptocurrency wallets.
After the incident, Binance gradually restored cryptocurrency withdrawals following additional security checks. To compensate for the losses, the company used the SAFU user protection reserve fund, insurance fund assets, and its own assets. On October 31, Binance said it had covered about 90% of the damage, and then announced the full recovery of the lost funds.
The U.S. Federal Bureau of Investigation blamed the North Korean hacking group TraderTraitor for the hack. According to the agency, the stolen assets are mainly being converted into Ethereum, after which they may be laundered through decentralized finance and instant cryptocurrency exchange services.
U.S. President Donald Trump, responding to journalists’ questions about the FBI’s findings, said that Washington does not yet have conclusive evidence of North Korea’s involvement. “We’re looking into it. We don’t know if it’s North Korea, but if it is, we’ll talk to them about it”, he said.
According to the analytics company TRM Labs, preparations for the attack began at least 36 hours before the theft. The hackers tested the mechanism with small transfers across ten blockchains, and withdrew the bulk of the funds in about 20 minutes. Binance and its partners froze about $3 billion in stolen assets, but freezing does not mean their actual return. The TraderTraitor group was previously linked to the hacking of the Bybit exchange, where assets worth about $1.5 billion were stolen in 2025, and to the theft of cryptocurrency worth $620 million in 2022.
Sources
