Record $6.3 Billion Binance Hack Linked to North Korea's TraderTraitor Unit

Binance, the world's largest cryptocurrency exchange, has suffered the biggest crypto theft ever recorded. On the evening of October 29, 2026, an attacker drained roughly $6.3 billion in digital assets from Binance wallets, and blockchain intelligence firms TRM Labs and Chainalysis have attributed the operation to TraderTraitor, an elite hacking unit working for the North Korean state. As of October 31, withdrawals remain suspended while the exchange rebuilds its reserves and hardens its systems.

How the attack unfolded

All times in this article are given in UTC.
The first unauthorized transfers appeared on the XRP Ledger shortly after 20:00 on October 29, when several Binance wallets sent out more than 233 million XRP. Within minutes, the attacker began repeatedly emptying Binance's main Ethereum hot wallet through a malicious smart contract designed to sweep funds as soon as they arrived. According to TRM Labs, the stolen assets moved across ten different blockchains, and the bulk of the theft was completed in about 20 minutes.

TRM valued the stolen crypto at roughly $6.36 billion based on prices at the time of each transfer. Binance itself puts the total impact at about $6.3 billion. Either figure makes this incident about four times larger than the $1.5 billion theft from the Bybit exchange in February 2025, which was previously the largest crypto heist on record. Bitcoin, ether, XRP, several stablecoins and tokens linked to the Trump family's World Liberty Financial project were among the affected assets.

Binance halted withdrawals at about 22:15, roughly two hours after the first suspicious transfer. Shortly after midnight, the exchange announced that both deposits and withdrawals were temporarily suspended while it carried out security checks.

The entry point: a compromised engineer laptop

In its first public explanation, Binance said the breach appears to have started on a laptop belonging to one of its engineers. That device allowed the attacker to reach a service container inside the company's infrastructure and submit withdrawal transactions that looked legitimate to internal systems. Co-CEO Richard Teng stressed that the operation was not a simple one-click action but a complex, multi-step intrusion. Binance has also said it found no evidence that any wallet private key had leaked.

Independent investigators see a broader problem. TRM Labs believes the evidence points to a compromise of Binance's hot wallet signing infrastructure rather than a phishing attack limited to Ethereum. TRM also found that preparation began at least 36 hours before the theft, with small withdrawals from the Tornado Cash mixer used to fund an operator wallet and transaction signatures obtained in advance, then executed in a single burst. Binance later confirmed that its investigation had uncovered additional breach points beyond the engineer's laptop.

Why investigators blame North Korea

TRM Labs said it attributes the attack to TraderTraitor with high confidence, based on both on-chain and off-chain intelligence. The firm highlighted strong similarities with the Bybit heist, which the FBI formally attributed to the same group, and with the KelpDAO hack of April 2026. Chainalysis reached the same conclusion after its investigators found Binance proceeds mixed on-chain with funds stolen from the Bitget exchange in September 2026, a theft of about $388 million already linked to North Korea. Singapore-based Pangolin Intelligence and independent investigator ZachXBT have also pointed to North Korean operators.

TraderTraitor is widely considered part of the larger Lazarus Group, and US cybersecurity authorities have warned since 2020 that it targets crypto companies through fake job offers, malicious software and compromised developer machines. Proceeds from these thefts are believed to help finance North Korea's weapons programs, which turns a crypto theft of this size into a global security concern. North Korea has not commented on the accusations.

About half of the stolen funds frozen

Because a large share of the loot was held in stablecoins, issuers were able to block a significant part of it quickly. Tether froze more than $1.567 billion in USDT linked to the attacker, and Circle froze more than $800 million in USDC in coordination with law enforcement. The FDUSD stablecoin was also frozen, and the Arbitrum Security Council blocked about $30.5 million in ARB and ether. Binance says the verified total frozen on-chain has reached about $3 billion, while blockchain analytics firm Elliptic estimates that around 44% of the stolen assets are now immobilized.

The remaining funds, mostly in bitcoin, ether and other non-freezable tokens, are still under the attacker's control and are being moved through many addresses. Even after the freezes, the amount the hackers still hold is larger than any previous crypto theft. Investigators expect the group to launder these assets gradually through cross-chain bridges, mixers and over-the-counter brokers before converting them into fiat currency.

Market shock

News of the breach sent the crypto market sharply lower on October 29 and 30. Bitcoin dropped about 4% to 5% and fell below $77,000, ether slid about 4% to around $2,200, and Binance's own BNB token lost more than 6%. Hundreds of millions of dollars in leveraged positions were liquidated within the first hour, and crypto-related stocks also fell. Standard Chartered warned that prices could keep falling until frozen assets are released and more technical details about the breach emerge.

Recovery plan and withdrawal restart

Binance has promised that customers will not bear the losses. The exchange has set aside more than $6.34 billion to cover the theft, drawing on its Secure Asset Fund for Users, part of its futures insurance fund and its corporate treasury. It has been buying replacement tokens through market and over-the-counter trades. On October 31, Binance said it had restored backing for 90% of the affected assets, up from about 80% a day earlier, and that major assets including BTC, ETH, USDT, BNB, SOL, USDC and XRP are now fully backed. Less liquid tokens make up the remaining gap.

Deposits are operating normally. Binance says it remains on track to start reopening withdrawals in phases on Sunday, November 1, subject to final security checks, and plans to publish a new proof-of-reserves report on Monday, November 2. A detailed technical report on the root cause is expected once the investigation is complete. Until withdrawals fully return, millions of users worldwide cannot move their funds off the platform, and market makers, payment providers and trading firms that rely on Binance liquidity face operational constraints.

What comes next

The key questions now are whether Binance can reopen withdrawals smoothly without new security issues and how much of the unfrozen loot investigators can still trace and block. Regulators and law enforcement agencies are expected to increase pressure on exchanges to strengthen custody controls, especially around hot wallets, signing systems and developer devices. The incident also confirms that North Korean hackers remain the most serious threat to the digital asset industry, with record thefts in 2025 and 2026 targeting exchanges, DeFi protocols and their software suppliers.