UPDATE: Binance replenishes up to 95% of funds following $6.3B breach
CIE News ·
Update to UPDATE: Binance records $3.64B in net outflows after reopening withdrawals
Confirmed by official primary sources.
Binance replenished 90% to 95% of stolen assets using reserves following a $6.3B breach attributed by the FBI to Lazarus Group. Tether and Circle froze nearly $2.85B in stablecoins.
Binance has replenished 90% to 95% of user assets using corporate reserves and its SAFU fund after a record breach drained between $6.3 billion and $6.36 billion from its hot wallets across 10 to 11 blockchains. As previously reported, Binance saw $3.64 billion in net outflows after phased withdrawal services resumed, which the exchange noted accounted for roughly 2.1% of its total $171 billion in platform assets.
The breach, executed on October 29, 2026, was attributed by the FBI to the North Korean state-backed Lazarus Group, also known as TraderTraitor. Hackers compromised an employee laptop with malware and leveraged an EIP-7702 multi-signature protocol to siphon assets over approximately 20 minutes, though no private keys were leaked. The losses included $3.8 billion on Ethereum, $1.5 billion (18,270 BTC) on Bitcoin, $628 million on TRON, and $296 million on XRP Ledger.
In response to the exploit, stablecoin issuers Tether and Circle froze nearly $2.85 billion in combined USDT and USDC across flagged addresses. Binance confirmed that net withdrawal volumes have stabilized following an initial spike immediately after services reopened on November 1, 2026.
Key facts
- $6.3B-$6.36B total breach
- 90%-95% of assets replenished
- $2.85B stablecoins frozen
- FBI links theft to Lazarus Group