North Korean Hackers Blamed for $6.3 Billion Cryptocurrency Theft from Binance
Binance crypto theft: How North Korean hackers perfected the heist and stole $6.3 billion in just 20 minutes
Hackers stole approximately $6.3 billion in cryptocurrency from Binance, the world’s largest cryptocurrency exchange, in an attack on October 29, 2026. The United States Federal Bureau of Investigation (FBI) has attributed the theft to TraderTraitor, a North Korean state-sponsored hacking operation. The incident has triggered an international response, with cryptocurrency companies, investigators and authorities working to trace and recover the stolen assets.
The attack unfolded over approximately 20 minutes on Thursday, October 29. According to blockchain analysis and reports reviewed by Reuters, the attackers drained cryptocurrency from wallets Binance uses to process transactions. The estimated value of the stolen assets was approximately $6.3 billion, making it one of the largest reported cryptocurrency thefts.
Binance initially suspected that a compromised employee laptop was involved. However, its subsequent investigation identified additional points of breach. The company described the incident as a complex attack but did not publicly provide a complete technical explanation of how the attackers gained control of the affected wallets.
Blockchain intelligence firm TRM Labs said the attackers compromised Binance’s transaction-signing infrastructure. By manipulating that process, they could direct affected wallets to send funds to addresses they controlled. Binance also said malicious software designed to delete evidence was involved.
On October 31, the FBI attributed the theft to North Korea and identified the operation as TraderTraitor, a name linked to previous North Korean cryptocurrency thefts. Before the announcement, blockchain analysis firms had cited similarities with earlier attacks, including the 2025 Bybit breach. Binance had initially said its investigation had not identified the attackers. North Korea has repeatedly denied involvement in state-linked cyber theft.
US authorities have accused North Korean cyber units of stealing digital assets to generate revenue and evade international sanctions. Cryptocurrency can cross borders outside conventional banking channels, although converting large sums into usable money leaves trails investigators can follow. The FBI did not specify the motive for this operation.
The attack targeted Binance’s operational wallets, not a confirmed mass breach of individual customer accounts. Binance said customer funds remained safe and pledged to absorb the loss. However, it suspended withdrawals, temporarily restricting users’ access to assets. Reuters reported that cryptocurrency prices fell on Friday as investors reacted.
Stablecoin issuers, including Tether and Circle, froze some stolen assets. Binance said it had raised about $3 billion with industry partners. The FBI said hackers were converting assets into Ethereum and warned of further laundering through decentralised finance platforms and instant-swap services. Frozen tokens are not automatically returned to Binance. Bitcoin and Ethereum cannot be frozen by a central issuer.
Binance said on October 31 that it had covered about $6 billion of the $6.3 billion loss by buying replacement tokens. The remaining amount, less than 10%, involved less-liquid assets that could take longer to source. The exchange used its Secure Asset Fund for Users, Futures Insurance Fund and corporate treasury. It said it would restore the protection fund to roughly $1 billion and had set aside about $6.34 billion to cover losses.
The FBI, US Secret Service and Internal Revenue Service’s Criminal Investigation division urged exchanges, blockchain operators and service providers to block transactions linked to identified laundering addresses. Binance said withdrawals were expected to resume on Sunday. It took a proof-of-reserves snapshot and said customers could verify one-to-one backing for ten listed tokens.
For users, Binance’s commitment to replace the stolen assets offers reassurance, but the withdrawal suspension showed how a breach can restrict access even when balances are protected. For the industry, the case has put transaction approval systems, employee devices and cooperation between exchanges and token issuers under scrutiny. The investigation continues.