The $6.3B Binance Hack, Explained: Is Your Money Safe?

If you saw the headline this weekend — the biggest crypto theft in history — your first thought probably wasn’t about Binance. It was about your own money. About $6.3 billion in crypto was drained from the world’s largest exchange, the largest theft the industry has ever recorded. Here’s what actually happened, what Binance says it’s doing about it, who investigators are pointing to, and the practical steps people use to keep their own crypto safer.

What happened

In late October, Binance discovered that attackers had drained roughly $6.3 billion worth of cryptocurrency. To put that in perspective, it comfortably passes the previous record — the roughly $1.5 billion taken from the Bybit exchange in February 2025 — making it the largest crypto theft on record.

Bar chart comparing the roughly 6.3 billion dollar Binance theft to the roughly 1.5 billion dollar Bybit theft in 2025. — The scale of the loss, next to the previous record.

Binance halted withdrawals while it responded, and as of November 1 it began reopening them in phases — Bitcoin first, then assets like Ether, BNB, and Solana, with around 15 in total. There’s no fixed timetable for the later stages.

One thing worth flagging early: the exact cause isn’t settled. Binance first pointed to a compromised laptop, then its CEO described the breach as “a more complex process” than that. A full post-mortem has been promised, so treat any single explanation of how it happened as provisional for now.

Binance’s response: “users won’t bear the loss”

This is the part that answers the question most people are actually asking. Binance’s CEO, Richard Teng, says the loss landed on company funds, not user accounts — and that Binance is absorbing the hit so customers don’t lose their holdings.

According to Binance, it has already replaced about 90–95% of the affected assets from its own reserves. (The exact figure varies by outlet, which is why it’s safest to say “about 90–95%.”) That money came from several buffers the company keeps for exactly this kind of event:

Its emergency SAFU fund (“Secure Asset Fund for Users”), worth roughly $1 billion, from which it pulled around $581 million (about 7,499 BTC);
A Futures Insurance Fund; and
The company treasury.

Co-CEO Yi He has said the company will top the SAFU fund back up to around $1 billion. (For the record, these are the people running Binance today — not founder Changpeng Zhao, known as CZ, who stepped back from the CEO role.)

A progress bar showing Binance says it has covered about 90 to 95 percent of affected assets from its own reserves. — Binance’s own figure for how much of the affected crypto it has already replaced.

Who did it? What investigators say

Here the honest answer is: it depends who you ask. The FBI, along with blockchain-analysis firms TRM Labs (which says it has “high confidence”) and Chainalysis, and the independent on-chain investigator ZachXBT, have linked the theft to North Korea — specifically the state-backed Lazarus Group and a cluster researchers call “TraderTraitor.”

The crucial caveat: Binance itself has not confirmed who was behind the attack. That attribution comes from outside investigators, not from an admission by Binance, so it’s a strong, expert-backed claim rather than a settled fact. North Korea–linked groups have become the most prolific crypto thieves in the world, with stolen funds widely reported to help the regime evade international sanctions — context that makes the attribution plausible, but context is not proof.

“Frozen” is not “recovered”

This is the detail most of the fast coverage skips, and it matters. Separate from the ~90–95% Binance has replaced from its own reserves, roughly $3 billion of the stolen crypto has been frozen in place by the companies that issue stablecoins: Tether froze about $1.6 billion, and Circle froze more than $800 million in USDC.

Frozen is not the same as returned. Freezing stops the coins from moving; actually clawing them back can take months or years, and may only be partial. So two different things are happening at once, and it’s easy to blur them:

Binance is making users whole from its own reserves now. The stolen coins themselves have mostly been frozen, not recovered — that’s a separate, slower process.

There’s a genuine debate underneath this. To some, stablecoin issuers freezing stolen funds is proof the system works. To others, it’s the uncomfortable opposite of crypto’s decentralization promise: if a central company can freeze these coins, it can freeze anyone’s.

So — is your money safe?

If you held crypto on Binance, the practical picture is reassuring but worth understanding clearly. Binance says you won’t lose your holdings, and it has covered the large majority from its own balance sheet. Access is returning as withdrawals reopen in phases.

But notice what that reassurance rests on: a company’s promise and its reserves, not the recovery of the stolen coins. There’s a long-standing phrase in crypto — “not your keys, not your coins” — that captures the underlying idea: when your crypto sits on any exchange, you’re trusting that company’s security and its solvency. Most of the time that’s fine. Events like this are a reminder of what you’re trusting.

How people protect their crypto

This is education, not advice — but these are the steps security experts repeat after almost every incident:

Keep on an exchange only what you’re actively using or trading, and move the rest off. An exchange is convenient, but it’s a custodian holding your coins for you.
Harden the email behind your account first. It’s the master key — if someone controls your email, they can often reset everything else.
Get your two-factor order right: a hardware security key is strongest, an authenticator app is a solid middle ground, and SMS codes are the weakest (vulnerable to SIM-swap attacks). Use SMS only as a last resort.
Turn on a withdrawal allowlist and an anti-phishing code if your exchange offers them.
If you self-custody, a hardware wallet keeps your keys offline on a device you hold. Buy it directly from the maker, never from a third-party seller or a used unit.
Write your recovery phrase down offline, never type it into a website or share it, and verify every transaction on the device’s own screen.

One honest caveat: self-custody moves the risk from the exchange to you. Lose your recovery phrase and no support team can get your money back. For a lot of people, a modest amount on a reputable exchange with strong security settings switched on is a perfectly reasonable middle ground.

What to watch next

The promised post-mortem, which should finally explain how the breach actually happened.
Whether the frozen funds are returned — and how much of the ~$3 billion.
Whether any government formally charges anyone.
The ripple effects on trust and regulation, and how smoothly the phased withdrawals reopen as a confidence signal.

The bottom line

This was the largest crypto theft on record. Binance says users are covered — mostly from its own reserves, not from recovering the stolen coins. The attribution points to North Korea, but Binance hasn’t confirmed it. And the roughly $3 billion that’s been frozen is not the same as money recovered. If you hold crypto, treat this as a prompt to check your own security settings — calmly, not in a panic.

This article is an explainer for general information and education. It is not financial, investment, or security advice, and it is not a recommendation to buy, sell, or hold anything. Figures around a developing story can change.