Key Highlights

  • Binance's chief financial officer announced on November 8, 2026 that he was stepping down after five years, ten days after hackers stole about USD 6.3 billion from the exchange on October 29.
  • The exchange named a successor who joined in May and said the change had been planned for six months, but the timing kept attention on the largest crypto theft on record.
  • Blockchain investigators reported on November 9 that the attackers created six home-made meme tokens on the NEAR network between November 5 and 7 to slow tracing of stolen funds.
  • Binance has said about USD 2.85 billion, or nearly 45% of the stolen assets, was frozen or intercepted, and that customer balances were replenished from its user protection fund.

What Happened Since the Hack

The theft began on October 29, when malicious code inserted into an internal wallet-signing service moved Assets across about ten blockchains, mostly within about 20 minutes. US authorities attributed the attack to a North Korean group known as TraderTraitor. Binance's own account, released on November 3 and detailed further in coverage on November 9, shows that the attackers spent months inside the company. In June, an engineer working on wallet systems installed a tainted software package while looking for an AI coding tool. In September, a second engineer was approached through a Job site by attackers posing as recruiters, who sent a coding test that carried malware. By October 20, the attackers had used that access and an internal AI tool to reach engineers who could approve deployments. Binance says it stopped 57 suspected North Korean intrusion attempts in 2026 before this one succeeded.

How the Funds Are Being Moved

Laundering stolen crypto is slow because exchanges and Stablecoin issuers can freeze tainted funds. The attackers have tried to add confusion. Investigators found that about 117,000 NEAR tokens, worth around USD 430,000, passed through six meme tokens created for about USD 90 each, while about 11.8 million NEAR, worth about USD 43.7 million, had not moved. None of the tokens traded after November 8. The technique slows investigators down rather than hiding funds, and a similar method was used after the Bybit hack in 2025. Stablecoin issuers froze large amounts early, and the attackers also deposited USD 60 million of a stablecoin on a lending platform to borrow about USD 44.6 million of ether, a Loan that remained over-collateralised. The use of thinly traded tokens, small transfers and multiple blockchains is designed to wear down tracing resources over time, so the fight over the remaining funds is likely to run for months.

Market Impact and Risks

The heist has weighed on crypto prices and confidence in centralised exchanges. Users withdrew an estimated USD 3.6 billion when withdrawals reopened on November 1, and Bitcoin traded around USD 74,000 to 75,000 on November 9, far below its record above USD 128,000. Senior departures add to questions about controls, even when planned. Legal uncertainty also matters, since Binance's terms fall under Abu Dhabi law and customers in some countries may have limited recourse. Further laundering, sanctions designations and any regulatory action against the exchange are the main risks to watch.

Where Things Stand

Ten days after the USD 6.3 billion theft, Binance has changed its chief financial officer, published details of a months-long intrusion, and seen attackers launder small amounts through meme tokens. About 45% of the stolen assets has been frozen or intercepted. The next markers are recovery of further funds, regulatory responses, and whether withdrawals and trading volumes stabilise.