Binance pledges to cover $6.3bn losses after historic crypto hack - thenational.co.za

Binance has pledged to cover approximately $6.3bn in losses following a cyberattack on October 29, as investigators examine a possible North Korean link and efforts to freeze the stolen funds.

The cryptocurrency exchange said it would use its Secure Asset Fund for Users and company funds to compensate customers, while Chainalysis estimated the theft at $6.4bn and linked it to the North Korean group TraderTraitor.

Binance has frozen about $3bn and temporarily suspended withdrawals while it strengthens security and publishes an updated Proof of Reserves.

Breach details

The incident involved unauthorised withdrawals from Binance hot wallets across multiple blockchains. Binance’s preliminary investigation suggested the attack may have involved a compromised DevOps engineer’s laptop.

This allegedly allowed an attacker to access a service container and submit unauthorised withdrawal transactions. The exchange said it had found no evidence that wallet private keys had been leaked.

North Korean link

Chainalysis said its investigators believed the attack was carried out by TraderTraitor, a North Korean cybercrime group known for targeting cryptocurrency exchanges and decentralised finance protocols.

The assessment was based on on-chain activity observed in the hours after the incident. Chainalysis said the stolen Binance funds had commingled with funds from a separate $387 million theft from cryptocurrency exchange Bitget last month.

According to Chainalysis, funds began leaving Binance hot wallets at approximately 4:20pm Eastern Time on October 29. On the Ethereum blockchain, the attacker allegedly used an operational wallet funded through Tornado Cash to submit signed authorisations.

The wallet was then used to transfer assets to addresses controlled by the attacker. The firm said the attacker attempted to move quickly to avoid having assets frozen.

Approximately $500m in stablecoins was moved into a wallet used to exchange assets that could be frozen for cryptocurrencies that are more difficult to freeze. Over nearly 20 minutes, the attacker exchanged $325m in stablecoins for $285m in Ethereum.

A further $175m in stablecoins was sent to other wallets in an apparent attempt to stay ahead of efforts to blacklist or freeze the funds. However, Chainalysis said freezes began at approximately 5:14pm Eastern Time.

Cyber resilience under scrutiny

The scale of the incident has renewed questions about whether financial institutions are adequately prepared for increasingly sophisticated cyber threats. Phoebe Hodgson, senior analyst for Banking and Payments at GlobalData, said the reported attack highlighted how criminals were increasingly exploiting trusted access and legitimate transaction processes.

Attackers are no longer focused solely on breaking into systems or stealing customer data. They are increasingly seeking to exploit the trust embedded within financial infrastructure, turning legitimate access and transaction processes into mechanisms for moving money.

She pointed to GlobalData’s Wealth Management Industry Conditions Analytics 2026, which found that cybersecurity threats were the greatest concern for 65% of surveyed wealth management institutions, up from 56% in 2025. The survey covered 478 wealth management companies across 20 markets in the second quarter of 2026.

Hodgson said the growing complexity of digital banking and artificial intelligence was creating new vulnerabilities, particularly as financial institutions became increasingly interconnected and reliant on automated processes.

She argued that cybersecurity strategies needed to move beyond preventing attackers from gaining access to systems. Banks and other financial institutions should assume that some security controls will eventually fail and design their operations to ensure that a single compromise does not result in catastrophic financial losses.

The next generation of cyber resilience will be defined not by whether institutions can prevent every breach, but by whether they can stop attackers from turning that breach into irreversible financial loss.

Next steps

Binance said its investigation was continuing and that it would publish a detailed technical post-mortem once the facts had been fully verified. The exchange also committed to publishing an updated Proof of Reserves once the remediation process was complete.