Binance Loses $6.3 Billion in Largest Crypto Hack, Linked to North Korean Group

Binance, the world's largest cryptocurrency exchange, reported that approximately $6.3 billion in digital assets were stolen on 29 October 2026. The theft is the largest cryptocurrency heist on record, exceeding the $1.5 billion Bybit hack of 2025. Blockchain analysis firms including TRM Labs, Chainalysis, and Elliptic have attributed the attack with high confidence to the North Korea-linked group TraderTraitor, associated with the Lazarus Group.

The breach began in the afternoon of 29 October. Attackers moved funds across at least ten blockchains, with the largest amounts taken from Ethereum ($3.8 billion) and Bitcoin (approximately 18,270 BTC valued at $1.5 billion). Additional withdrawals occurred on XRP Ledger, Avalanche, and Polygon. Binance stated that deposits were unaffected. Withdrawals were suspended and later resumed. The exchange said it would cover all user losses and worked with partners to freeze roughly $2.7 to $3 billion in stolen assets.

TRM Labs described the operation as matching earlier North Korean patterns, including the speed of movement and the use of multiple chains. An attacker transferred large sums out of Binance wallets in about 20 minutes. Binance's initial investigation pointed to a compromised laptop, but later findings indicated additional points of breach in its hot-wallet signing infrastructure. The company has not released a full technical report.

North Korean state-linked groups have conducted a series of major exchange and bridge hacks since 2022, generating hundreds of millions of dollars that Western intelligence agencies say fund the country's weapons programmes. The Binance incident is the largest single theft of any kind according to Elliptic's chief scientist. The frozen portion reduces the immediately available proceeds, but the remaining funds are already moving through mixers and cross-chain bridges that have previously complicated recovery efforts.

Users reported temporary inability to withdraw during the suspension. Binance has begun restoring access and has published or plans to publish an updated proof-of-reserves statement. The exchange's scale means the $6.3 billion figure, while large in absolute terms, represents a fraction of total assets under custody. The incident nonetheless raises questions about the security of centralised hot wallets that hold customer funds in a form that can be signed and moved quickly.

Regulators in multiple jurisdictions have increased scrutiny of exchange security practices after successive large hacks. The US, South Korea, and Japan have previously sanctioned North Korean cyber units and sought to disrupt their laundering networks. Recovery of the unfrozen portion will depend on cooperation between Binance, blockchain analytics firms, and law enforcement. Past cases have shown that a portion of stolen funds can be seized when they reach regulated exchanges, but a substantial share typically remains outside easy reach.

The 29 October attack adds to the cumulative losses attributed to North Korean cyber groups. For Binance and other large exchanges, the immediate task is restoring user confidence and closing the specific vulnerabilities that allowed the rapid movement of billions of dollars. For the broader industry, the episode underscores the persistent risk that state-linked actors pose to centralised platforms holding large balances in hot wallets.