North Korean-linked hackers steal $6.3 billion from Binance in largest crypto heist

On October 29, 2026, attackers drained approximately $6.3 billion in digital assets from Binance hot wallets across multiple blockchains in roughly 20 minutes. Blockchain intelligence firms TRM Labs, Elliptic and Chainalysis linked the theft to North Korea’s TraderTraitor unit, part of the Lazarus Group. The FBI later confirmed the attribution.

Binance co-CEO Richard Teng stated that an initial investigation pointed to a compromised engineer’s laptop that allowed access to a service container used for withdrawal transactions. The company said further points of breach were identified. Most of the funds left Ethereum and Bitcoin addresses, with smaller amounts on other chains including Avalanche and Polygon.

TRM Labs calculated that roughly $3.8 billion of the total came from Ethereum, while about 18,270 Bitcoin accounted for another $1.5 billion. The attackers moved funds rapidly. One transaction shifted 17,260 Ether to a new wallet early the next day. Firms tracking the flows noted similarities to the February 2025 Bybit hack, which TraderTraitor also carried out and which totaled $1.5 billion.

Binance suspended withdrawals and began working with partners to freeze assets. By October 31 the exchange reported that it had replenished 90 percent of the losses from its Secure Asset Fund for Users and company reserves. It set a target of resuming withdrawals on November 1 and planned to publish a proof-of-reserves report on November 2. Teng said the exchange had set aside $6 billion to cover all customer losses.

The scale exceeds every previous cryptocurrency theft. The 2025 Bybit incident had stood as the largest. Investigators observed that some of the Binance funds later mixed with proceeds from a smaller Bitget exploit also attributed to North Korean actors. Of the $6.3 billion, roughly $2.7 billion to $3 billion was frozen through coordinated action by exchanges, issuers and analytics firms. The remainder remains under attacker control or in less liquid tokens.

North Korean state-linked groups have conducted repeated large-scale crypto thefts to generate revenue under sanctions. The FBI has previously designated TraderTraitor for earlier operations. Binance has not publicly named a perpetrator. Its statements emphasize customer fund safety and ongoing cooperation with law enforcement.

The incident raises questions about the security of centralized exchange hot wallets that hold large customer balances for liquidity. Hot wallets must remain online and accessible, creating a persistent attack surface. Cold storage protects longer-term holdings but cannot support rapid withdrawals. The 20-minute window shows how quickly compromised signing infrastructure can empty those balances once an attacker gains the ability to authorize transfers.

Market reaction remained limited in the immediate hours after the announcement. Bitcoin declined modestly on the day of the theft and the following session. Binance continued to operate trading on most pairs while withdrawals stayed paused. The company has said it expects normal service to resume within days once remaining frozen assets are accounted for and remaining customer claims are settled from reserves.

For users, the practical consequence is temporary inability to move funds off the platform. Binance has stated that customer balances remain intact because losses will be absorbed by the exchange. The longer-term effect is likely tighter scrutiny of exchange security practices and of the on-chain laundering paths used by state-linked groups. Analytics firms continue to monitor wallets that received the stolen assets for further movement into mixers or decentralized exchanges.