Binance Hack: North Korea's $6.3B Crypto Heist Explained
On Thursday night, October 29, 2026, hackers drained about $6.3 billion in cryptocurrency from Binance, the world's largest crypto exchange, in roughly 20 minutes. It is the largest cryptocurrency theft in history — nearly four times bigger than the previous record. Blockchain analysis firms say the attack bears the fingerprints of North Korea's elite hacking unit, and about $3 billion of the stolen funds has already been frozen. Binance says it will cover all losses and that user funds are safe. Here is everything we know so far, what is still unconfirmed, and what it means if you hold crypto on Binance.
Quick answer: Hackers moved an estimated $6.3 billion out of Binance's wallets on October 29, 2026, across 10 blockchains. TRM Labs and Chainalysis attribute the attack with high confidence to TraderTraitor, a North Korean hacking unit linked to the Lazarus Group. About $3 billion has been frozen by stablecoin issuers and partners. Binance has set aside $6.34 billion to cover losses, paused withdrawals, and expects to resume them within about 48 hours. Attribution is not yet confirmed by Binance or US investigators.
Table of contents
- What happened: the 20-minute drain
- How much was stolen — and where is it now?
- Who is behind it? The North Korea link
- How did the hackers get in?
- What Binance is doing about it
- What this means for Binance users
- Binance vs Bybit: the two biggest crypto heists
- Frequently asked questions
What happened: the 20-minute drain
According to an initial report from blockchain intelligence firm TRM Labs, the attack began at around 7 p.m. Paris time on Thursday, October 29 — shortly after 2000 GMT. Over about 20 minutes, an attacker moved approximately $6.36 billion out of Binance wallets on 10 blockchains. Bitcoin, Ethereum, Solana, and stablecoins such as USDT and USDC were among the assets taken, along with smaller tokens.
The theft did not come out of nowhere. TRM Labs estimated that the first attempts started on the morning of Wednesday, October 28, when small, discreet withdrawals were made from individual wallets — most likely to test whether the attack route worked before the main drain on Thursday evening.
Binance, which says it has 335 million registered users globally, suspended deposits and withdrawals on Thursday as its security teams investigated. By Friday morning, users could not move crypto off the exchange, although deposits remained open. The company said it expected to gradually resume withdrawals within about 45 hours, and later said withdrawal services should return by Sunday morning.
How much was stolen — and where is it now?
The exact total depends on who is counting, because crypto prices move and different firms measure at different moments. Treat every figure below as an estimate:
- TRM Labs: about $6.36 billion moved out of Binance wallets.
- Binance: an estimated $6.3 billion impact — and the company set aside more than $6.34 billion in company resources to restore customer balances.
- Chainalysis: about $5.912 billion confirmed stolen at the time of theft, moving across Bitcoin, Ethereum, Tron, Ripple, and several Layer 2 networks.
About half the money was stopped quickly. Binance said partners froze roughly $3 billion in affected assets. Stablecoin issuers did most of the freezing: Tether froze about $1.6 billion in USDT, Circle froze more than $800 million in USDC, and Ripple and World Liberty Financial also froze funds. TRM Labs estimated about $2.7 billion was immobilized through these measures. Frozen stablecoins cannot be spent — which is why the attackers' remaining haul is mostly Bitcoin and Ether, assets nobody can freeze.
That remainder is large. TRM Labs estimated the hackers managed to steal and "secure" about $2.4 billion in Bitcoin and Ether that is beyond reach. Blockchain intelligence firm Bitquery put about $3.1 billion in attacker-controlled wallets as of early October 30, including roughly 18,270 BTC spread across 19 wallets and more than 490,000 ETH — most of it sitting untouched. TRM also said some stolen funds had already been posted as collateral to borrow Ether, and about $729 million in stolen USDT was swapped for ETH and TRX before the freezes took effect.
The market noticed. Bitcoin fell to a six-week low of about $76,470, down around 3%, while Ether dropped more than 3% to about $2,186, according to Reuters market data on Friday.
Who is behind it? The North Korea link
Two US blockchain analysis firms have pointed at the same suspect. TRM Labs said it assessed with "high confidence" that the attack was carried out by TraderTraitor, which it describes as North Korea's elite hacking unit, linked to the widely known Lazarus Group. Chainalysis reached the same conclusion: its CEO, Jonathan Levin, said the firm assessed the hack was "likely done by DPRK group TraderTraitor," citing links to a previous hack. Blockchain investigator ZachXBT also said in a post on X that the attacker was "likely Lazarus."
Some caution is warranted. One person familiar with crypto investigations told CoinDesk the hack was not definitively attributed to Lazarus yet, and Binance itself has said its investigation has not attributed responsibility to any individual. North Korea routinely denies involvement in hacking, and its missions in Geneva and China had not commented on the claims at the time of writing. The FBI said on Friday that it was aware of the incident and engaged with partners to understand its scope, while the US Secret Service said its investigators were working around the clock with private-sector partners including Circle to identify, freeze, trace, and recover the stolen funds.
The Lazarus Group is regarded as an umbrella term for several subgroups operating under North Korea's Reconnaissance General Bureau, its primary intelligence service. The US Treasury sanctioned Lazarus in 2019. South Korea's spy agency estimated in December 2022 that North Korean hackers had stolen about $1.1 billion in crypto and other virtual assets over five years. For Pyongyang, crypto theft has become a significant source of foreign currency, helping fund a nuclear programme that is under United Nations sanctions, according to experts. AI built for cybersecurity — like Google's Gemini 4 Carbon — shows how the same technology is now being aimed at defense as well as attack.
TRM Labs also noted that several features of the Binance attack match earlier North Korea-linked heists, and that the attackers ordered Binance's wallets to empty into wallets they controlled — mirroring the Bybit hack of February 2025, which the FBI attributed to the same unit. As governments respond to AI-era threats, some are reaching for bans and restrictions — Sweden's move to block ChatGPT and Claude shows how fast the policy backlash can arrive. The scale of the problem keeps growing: AI and cybercrime statistics for 2026 put last year's crypto theft at $2.9 billion across nearly 150 attacks, according to TRM Labs.
How did the hackers get in?
Binance's initial investigation pointed to a compromised laptop belonging to a DevOps engineer. According to the exchange, that access allowed an attacker to reach a service container and submit unauthorized withdrawal transactions through internal systems. Binance co-CEO Richard Teng said on X that the attack was not a "one-click" action but a complex process, and that the investigation had found no evidence of any wallet private key leak.
That distinction matters. If private keys had leaked, every Binance wallet would potentially be at risk. A compromised internal system is serious, but it is a narrower failure — and one Binance says it can fix by securing its wallet infrastructure and checking its systems before reopening withdrawals. Binance later said a subsequent investigation had uncovered additional details, but had not publicly confirmed a final cause. The investigation is ongoing.
The method echoes the Bybit heist, where attackers manipulated the interface of a wallet system to redirect a transfer. In both cases, the thieves did not break Bitcoin or Ethereum themselves — they broke the human and software processes around the wallets. AI-driven social engineering is part of the same threat landscape: AI voice cloning scams show how cheaply attackers can now impersonate trusted people, and AI agents with deep system access raise the same question this hack poses — what happens when a trusted insider process is turned against itself?
What Binance is doing about it
Binance's response has been fast and expensive. The exchange said it set aside more than $6.34 billion in company resources to restore customer balances, with $5 billion already held in the exact token assets that were affected. The figures do not include the frozen assets. The company's Secure Asset Fund for Users (SAFU), an emergency reserve that typically holds around $1 billion in Bitcoin, is part of the backstop. Co-founder Yi He said the company would cover "all hacking losses," and Binance has repeatedly stated that user funds are safe.
Operationally, Binance worked with blockchain partners to freeze about $3 billion, began recovering assets for users on Friday, and is working with law enforcement and blockchain intelligence firms to trace the rest. Withdrawals remain paused while security teams complete checks and secure wallet infrastructure. Binance.US, a separate exchange, said it was not affected by the incident.
What Binance has not done yet is name the attacker or publish a full technical post-mortem. Both are expected as the investigation continues — and both matter, because the credibility of the "user funds are safe" promise rests on whether the hole is genuinely closed.
What this means for Binance users
If you hold crypto on Binance, here is the practical picture as of Friday, October 30:
- Your balances are covered, according to Binance. The exchange says it will restore all customer balances from company resources. That is a company promise, not an insurance payout — but Binance's reserves are large: about 688,572 BTC (roughly €47 billion) and 3,799,136 ETH (€7.5 billion) as of October 1, per its proof-of-reserves page.
- Withdrawals are paused, deposits are open. Expect withdrawals to resume gradually within about 48 hours of the attack. Do not trust social-media posts claiming an earlier reopening — check Binance's official X account and status pages.
- Beware the second wave: scams. Major hacks always trigger fake "support" accounts, phishing links, and bogus "recovery" offers. Binance will never ask for your password or seed phrase. If someone contacts you offering to recover funds, it is a scam.
- Consider where you keep large balances. Keeping trading funds on an exchange is convenient; keeping long-term holdings in a hardware wallet you control removes exchange risk entirely. This hack is a reminder of why that trade-off exists.
- Watch for official updates only. Figures in this story are still moving — frozen totals, recovered amounts, and the final cause will change. Follow Binance's official statements, TRM Labs, and Chainalysis rather than rumor threads.
Binance vs Bybit: the two biggest crypto heists
| Fact | Binance (Oct 2026) | Bybit (Feb 2025) |
|---|---|---|
| Amount stolen | ~$6.3 billion (est.) | ~$1.5 billion |
| Duration of main theft | ~20 minutes | Single transfer, manipulated interface |
| Blockchains hit | 10 | Primarily Ethereum |
| Attack vector (initial findings) | Compromised DevOps laptop → internal systems | Compromised Safe wallet interface |
| Attribution | TRM/Chainalysis: high confidence, TraderTraitor (DPRK); not yet confirmed by Binance/FBI | FBI: TraderTraitor / North Korea |
| Frozen / recovered | ~$3 billion frozen by partners | Small fraction recovered |
| User losses covered? | Yes — Binance pledged $6.34B | Yes — Bybit covered via reserves/loans |
The Binance heist is roughly four times larger than Bybit's — and it happened despite the industry spending 2025 hardening wallet systems after Bybit. That is the uncomfortable lesson: the attackers adapted faster than the defenses.
Frequently asked questions
How much money was stolen from Binance?
About $6.3 billion, according to Binance's own estimate. TRM Labs put the figure at $6.36 billion moved out of Binance wallets, while Chainalysis confirmed about $5.912 billion stolen at the time of theft. The totals differ because firms measured at different moments while crypto prices moved. Roughly $3 billion has been frozen by partners.
Who hacked Binance — is North Korea confirmed?
Not confirmed. TRM Labs and Chainalysis both assess with high confidence that the attack was carried out by TraderTraitor, a North Korean hacking unit linked to the Lazarus Group. But Binance has not attributed the attack to any individual, and one investigator cautioned that attribution was not yet definitive. The FBI and Secret Service are involved in the investigation.
Is my money on Binance safe?
Binance says yes — it has set aside more than $6.34 billion to restore all customer balances and says user funds are safe. The exchange's reserves are far larger than the loss. Treat this as a company pledge rather than a guarantee, and follow official updates as the investigation continues.
Can I withdraw my crypto from Binance right now?
Not yet. Binance paused withdrawals after the attack while it runs security checks and secures its wallet infrastructure. Deposits remain open. The exchange expected to gradually resume withdrawals within about 45–48 hours, and said services should return by Sunday morning, October 31–November 1.
Was Binance.US affected?
No. Binance.US, a separate cryptocurrency exchange, said it was not affected by the incident. The hack hit Binance's global platform wallets.
Will the stolen crypto be recovered?
Partly, already. About $3 billion in stablecoins was frozen by issuers and partners, and Binance says it has begun recovering assets. The remaining Bitcoin and Ether — roughly $2.4–3.1 billion — cannot be frozen and sits in attacker-controlled wallets. Full recovery of that portion is unlikely unless investigators identify the holders.
Verdict
The Binance hack is the largest crypto theft ever, and the North Korea attribution — while high-confidence from two respected firms — is not yet confirmed. What is confirmed is more useful: about $3 billion was frozen within hours, Binance is covering all losses, and the attack exploited internal systems rather than the blockchains themselves. For users, the lesson is the same one every exchange hack teaches: keep trading funds on exchanges and long-term holdings somewhere only you control. And for the industry, the lesson is harsher — after Bybit, the defenses improved, and the attackers improved faster.
📚 Read next:
Methodology: This article is based on statements from Binance, TRM Labs, and Chainalysis, and reporting by Al Jazeera, CNN, Reuters, CoinDesk, and Le Monde, published October 29–30, 2026. Figures are estimates from blockchain analysis and are still developing. No sponsorship or affiliation with Binance. Last updated: October 31, 2026. About The AI Tools · Home
Sources: TRM Labs — North Korea steals $6.36B from Binance · CoinDesk — Binance arranges $6.34B to cover losses · Al Jazeera — What we know · Reuters — Analysts react · CNN — Suspected North Korean hack
Comments
Post a Comment