Key takeaways
- Binance said roughly $6.3 billion was affected in a hack that began late on October 29, 2026, which blockchain analysts describe as the largest cryptocurrency theft on record.
- TRM Labs, Chainalysis and Elliptic attribute the attack to North Korea's TraderTraitor group, but Binance has not named the culprits and no government agency had confirmed the attribution at the time of writing.
- Binance froze about $3 billion of the affected assets, suspended withdrawals and pledged to reimburse all losses from company funds.
- The case matters geopolitically because experts say North Korea uses crypto theft to raise foreign currency for its economy and nuclear programme despite United Nations sanctions.
The Binance hack, in which about $6.3 billion in digital assets left the world’s largest cryptocurrency exchange on October 29, 2026, has been attributed by blockchain analysts to North Korea. No government has yet confirmed that attribution. If it holds, it would be the largest crypto theft on record and a direct test of the sanctions meant to restrict Pyongyang’s access to hard currency. Binance has suspended withdrawals and says it will cover all losses.
What happened in the Binance hack?
According to CBC News, the blockchain firm TRM Labs said an attacker moved roughly $6.36 billion out of Binance wallets on 10 blockchains, most of it in about 20 minutes. The Associated Press reported that Binance said late on Thursday that approximately $6.3 billion was affected, and that about $3 billion has been frozen with the help of blockchain partners.
Binance’s first assessment pointed to a compromised laptop belonging to a DevOps engineer, which gave an attacker access to a service container and let them submit unauthorized withdrawals, according to CNN. In a later statement carried by US News, the company said a further investigation had found additional “points of breach” and that deposits were unaffected.
Binance said withdrawals were expected to resume within a day or two and that it would cover all losses. According to SecurityWeek, the reimbursement would draw on company funds and its Secure Asset Fund for Users. CCN reported that Bitcoin fell below $80,000 after the announcement.
Why is North Korea blamed for the Binance hack?
TRM Labs and Chainalysis, two US blockchain analysis firms, said they were highly confident that North Korea was responsible, Reuters reported. The British firm Elliptic said it also believed North Korea was behind the theft. The group named is TraderTraitor, which TRM described as North Korea’s elite hacking unit.
The attribution rests on pattern matching. TRM said the attackers were able to order Binance wallets to empty into wallets they controlled, mirroring the February 2025 theft of $1.5 billion from the exchange Bybit, which the FBI attributed to North Korea, according to Reuters. CNBC reported that TRM also cited preparations made well before the theft and transaction signatures obtained in advance. Chainalysis chief executive Jonathan Levin wrote on X that the hack was “likely done by DPRK group TraderTraitor,” using the abbreviation for North Korea’s formal name.
Binance has not publicly identified the attackers. A spokesperson told CBC News that the company is working with law enforcement partners to confirm who was responsible. CNN said it had asked the FBI and the US Secret Service for comment.
Why does the Binance hack matter for sanctions?
The AP reported that experts say North Korea has turned to crypto hacking as a source of badly needed foreign currency for its economy and its nuclear programme, after tough United Nations sanctions and other difficulties. A theft of this scale, if confirmed as state-linked, would suggest that those sanctions are being bypassed through cyber operations rather than conventional trade.
The trend predates this incident. A Chainalysis report summarized by UPI found that North Korean hackers stole a record $2.02 billion in crypto in 2025, about 60 percent of the $3.4 billion stolen worldwide that year. The same report said about 40 percent of such proceeds are used to fund weapons development. At $6.3 billion, the Binance figure would exceed that entire annual total, although the two numbers measure different things and the Binance loss is a gross figure that Binance says it will repay.
Sanctions enforcement is also under strain elsewhere, as the debate over Russia sanctions after the Dnipro rail strike shows. Pyongyang’s cyber revenue adds a separate channel that restrictions on trade and shipping do not reach.
Can the stolen funds be recovered?
Partly. Blockchain firm TRM counted about $2.7 billion frozen as of 00:30 UTC on October 30, while Binance later reported about $3 billion, according to CCN. CNBC cited an analyst, Farrell, estimating that around $3.3 billion remained unfrozen. CCN also noted that freezing assets does not by itself return them to Binance.
Security specialists have raised questions about the exchange’s controls. Kok Tin Gan, chief executive of the cybersecurity firm NyxLab, told the AP that the event raises questions about why stronger approval controls were not in place. Changpeng Zhao, the co-founder who stepped down as chief executive in 2023, wrote on X that “User funds are safe!” and said he expects them to be fully covered, according to CBC News. The US News report notes that President Donald Trump pardoned Zhao in 2025.
What to watch
- Official attribution: whether the FBI or the US Treasury publicly attributes the theft to North Korea, as the FBI did after the Bybit theft within days.
- Withdrawals: whether Binance reopens withdrawals within the “day or two” it has indicated, and whether outflows spike when it does.
- Frozen funds: any movement in the roughly $3.3 billion that analysts say remains unfrozen, and whether stablecoin issuers and other exchanges freeze more.
- Binance’s findings: a fuller account of the “points of breach” its second investigation identified.
- Sanctions response: new designations of wallet addresses or laundering services, or coordinated statements from the United States, South Korea and Japan.
Frequently asked questions
Who is blamed for the Binance hack?
Blockchain analysis firms TRM Labs, Chainalysis and Elliptic attribute the theft to North Korea's TraderTraitor hacking group. Binance has not publicly named the attackers, saying it is working with law enforcement. At the time of writing, no government agency had confirmed the attribution for this incident.
How much was stolen in the Binance hack?
Binance said approximately $6.3 billion was affected. TRM Labs put the amount moved from Binance wallets at about $6.36 billion across 10 blockchains, mostly within 20 minutes. Roughly $3 billion has been frozen, and Binance says it will cover all losses from company funds.
Are users' funds safe after the Binance hack?
Binance says deposits were unaffected and it will reimburse all losses, using company funds and its user protection fund. Withdrawals are suspended and were expected to resume within a day or two. Founder Changpeng Zhao wrote that he expects user funds to be fully covered.
Sources
- North Korea linked to $6.3 billion hack on Binance, blockchain intelligence firms say (AP)
- Binance says $6.3B US hacked in what could be largest cryptocurrency theft ever (CBC News)
- Hackers steal $6.3 billion from Binance in record heist blamed on North Korea (Reuters)
- Binance: North Korea suspected in record $6 billion theft (CNN)
- Binance's $6.3 billion hack: What we know and what comes next (CNBC)
- $6 Billion Binance Hack Bears Hallmarks of North Korea's TraderTraitor (SecurityWeek)
- Blockchain Intelligence Firms Link North Korea to $6.3B Hack on Binance (US News)
- Binance's $6.3 Billion Hack: North Korea Linked to Record Theft (CCN)
- Report: North Korean hackers stole a record $2.02B in crypto in 2025 (UPI)
Top image: Facebook / Wikimedia Commons (Public domain)
This article was produced by the Intelligence Report Desk. Sources are linked below.
1 Comment
Pingback: FinCEN Minnesota Suspicious Wire Payments: What the $8B Figure Means – Intelligence Report