Binance Loses $6.3 Billion in Largest Crypto Theft on Record; Analysts Point to North Korea

By Kaeleb Savon Heck

Oct. 31, 2026 — Hackers stole roughly $6.3 billion in cryptocurrency from Binance, the world's largest crypto exchange, in an attack that blockchain analysts are calling the largest theft of its kind on record and are attributing to a North Korean state hacking unit. Binance says customer funds are safe and that it will cover all losses, but withdrawals were still switched off as of Saturday while the company rebuilds the system the attackers abused.

Most of the money left Binance wallets in about 20 minutes on the evening of Oct. 29, starting at 20:05 UTC, which was just after 4 a.m. on Oct. 30 in Manila, according to the blockchain intelligence firm TRM Labs. TRM put the total at about $6.36 billion across ten blockchains, roughly four times the $1.5 billion stolen from the exchange Bybit in February 2025, which had been the previous record.

About $2.7 billion has since been frozen by stablecoin issuers and other partners, TRM said. That still leaves an estimated $2.4 billion, mostly in ether and bitcoin, in the attacker's hands and beyond the reach of any company that could freeze it.

Why this matters

Binance describes itself as the largest crypto exchange by trading volume, and the BBC reported it is estimated to have more than 300 million registered users. An attack of this size tests two promises the industry makes to ordinary customers: that exchange wallets are secure, and that when something goes wrong, users will be made whole.

It also shows how modern breaches work. The blockchain itself was not broken. Instead, investigators say, the attackers got into the systems that people and companies trust to approve transactions, and made those systems do the work for them.

How the attack happened

Binance said its initial investigation pointed to a "compromised" DevOps engineer's laptop, which "allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," TechCrunch reported, citing the company's post on X. Binance said it had seen no evidence that its wallet private keys had leaked.

Co-CEO Richard Teng later said that the laptop was only part of the story. "This was not carried out by one person," he said in a video statement reported by the BBC. "Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach."

Teng said the attackers used Ethereum's EIP-7702 mechanism to take control of a Binance hot wallet, the internet-connected wallet an exchange uses to process customer withdrawals. He said the transfers "did not pass through our normal approval controls," and that the attackers used "a self-destruct mechanism that destroyed tooling and traces as they went."

TRM's technical analysis fills in more detail. EIP-7702, added to Ethereum in May 2025, lets an ordinary wallet hand its behavior over to a smart contract by signing an authorization. TRM said the attacker submitted a single transaction containing 50 authorizations signed by the Binance hot wallet in advance, each one matching a different position in the wallet's transaction count. Because the busy wallet's count kept moving, preparing 50 of them guaranteed that one would still be valid. One was. About three and a half minutes later, the attacker told the wallet to send its entire balance, including 167,464 ETH and 1.615 billion USDT, to an attacker-controlled address.

At the same time, Binance wallets on nine other networks, including Bitcoin, Tron, the XRP Ledger and Solana, sent funds to the attacker through ordinary signed transfers. In TRM's assessment, the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across several chains. Binance has not yet published a full root cause.

Ari Redbord, TRM's chief policy officer, told the BBC that the attacker's operator wallet had been funded about 36 hours before the theft. "That speed is the product of long preparation," he said.

Who is behind it

TRM said it attributes the attack "with high confidence" to TraderTraitor, a North Korean hacking unit also widely referred to as part of the Lazarus Group. The FBI named the same group as responsible for the Bybit theft. TRM pointed to familiar patterns, including small withdrawals from the mixing service Tornado Cash to fund an operator wallet, staging that began well before the theft, and signatures obtained in advance and executed in a single burst.

Chainalysis told the BBC it also had a "high degree of confidence" that North Korea was behind the attack, and said it saw stolen Binance funds "commingling" with funds from another exchange hack last month. Elliptic, another blockchain analytics firm, said some of the stolen funds ended up in the same wallet used in the $351 million hack of the exchange Bitget earlier this year, TechCrunch reported.

North Korea has always denied involvement in such hacks. Binance did not respond to the BBC's questions about a possible North Korean link.

The response

The FBI said it is "aware of the incident and is engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts, and coordinate appropriate investigative steps." The U.S. Secret Service said it is "working around the clock" with private-sector partners "to identify, freeze, trace, and recover funds," in coordination with the U.S. Attorney's Office for the District of Columbia.

Stablecoin issuers moved within the first hour. TRM said Tether froze about 1.77 billion USDT, Circle froze about 825 million USDC, Ripple froze 40.5 million RLUSD, and World Liberty Financial froze 27.8 million USD1. Arbitrum's Security Council used emergency powers to pull about $30 million in ETH and ARB out of an attacker wallet on its network. A Binance spokesperson told TechCrunch that about $3 billion had been frozen by industry partners.

The attacker raced those freezes, TRM said, selling about 325 million USDT for ether at a steep discount and borrowing ether against stablecoins on the lending protocol Aave before Aave froze the affected markets.

Not every estimate agrees on the total. The security news site infosecpwn noted that The Block reported suspicious outflows of up to $5.8 billion and that press reports citing Chainalysis put the figure near $5.9 billion, compared with Binance's own figure of about $6.3 billion. TRM's $6.36 billion number values each transfer at the moment it was taken.

What Binance customers should know

Binance says it has reserved more than $6.3 billion to cover the incident and that losses will be covered through company funds and its emergency insurance fund, known as SAFU, the BBC reported. Teng said the "vast majority" of user assets sit in cold storage and move into a hot wallet only when a customer withdraws.

Teng said withdrawals will not return until a rebuilt service "passes rigorous testing," and that the company was on track to restore them within about 40 hours of his statement. TokenPost reported that Binance is targeting a restart by Sunday, Nov. 1, that deposits are operating normally, and that a full proof-of-reserves report is planned for Monday, Nov. 2. The company has said it will publish an initial view before then.

The BBC advised customers to check balances, transaction history and security notifications in the official app or website; log out of all sessions and change passwords if anything looks wrong; and use an authenticator app or passkey instead of text-message codes. A clean-looking account is not a guarantee that nothing was affected. Customers should also expect scammers to exploit the news with fake "refund" or "verification" messages, and should only follow instructions found inside the official app or website.

Analysis

The Binance theft fits a trend security researchers have been warning about: attackers are going after the people and machines that run critical systems, not the systems themselves. Mackenzie Jackson of the security firm Aikido told the BBC that developer devices are attacked every day and that a single laptop can open "one internal system, then another, until they reach a service trusted to send out withdrawals." Because those withdrawals travel through a legitimate route, he said, they can look routine.

TechCrunch noted that Binance will face questions about why one employee's laptop could reach systems capable of moving billions of dollars. TRM's recommendations to other exchanges point in the same direction: watch treasury wallets for unexpected EIP-7702 delegations, reject such authorizations unless they are expected, treat requests for many authorizations at once as a sign of compromise, and separate signing systems by chain and wallet type so one breach cannot drain ten networks.

The market reaction was muted compared with past crypto crises. The BBC reported that bitcoin fell roughly 4% to 5% after the news. But with withdrawals frozen on the largest exchange, the real test of confidence will come when customers can move their money again.

What's next

• Nov. 1: Binance's target for restarting withdrawals, subject to security testing.
• Nov. 2: Planned full proof-of-reserves report.
• Laundering: TRM expects the attacker to move funds through cross-chain bridges, swap services and over-the-counter brokers, giving investigators chances to intervene when crypto is converted to cash.
• Root cause: Binance has promised a fuller account of how its signing systems were reached.

Sources

• TRM Labs, "North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History," Oct. 29-30, 2026: https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history
• TechCrunch, "North Korean hackers blamed for stealing record $6.3B in Binance breach," Oct. 30, 2026: https://techcrunch.com/2026/10/30/north-korean-hackers-blamed-for-stealing-record-6-3b-in-binance-breach/
• BBC News, live coverage of the Binance hack, Oct. 30, 2026: https://www.bbc.com/news/live/cqrmynd3042gt
• TokenPost, "Binance Targets Nov. 1 Withdrawal Restart, Plans Reserve Report," Oct. 30, 2026: https://www.tokenpost.com/news/business/44892
• infosecpwn, daily security roundup, Oct. 30, 2026: https://infosecpwn.com/news/2026-10-30/