Binance Confirms Biggest-Ever $6.3B Hack, North Korea Blamed
Binance says Thursday’s breach began with a compromised engineer’s laptop and cost an estimated $6.3 billion, the largest crypto theft on record, as investigators link it to North Korea.
Key Takeaways
- Compromised engineer laptop enabled unauthorized withdrawals.
- Binance estimates impact at about $6.3 billion.
- Around $3 billion frozen with blockchain partners.
- TRM, Chainalysis tie attack to North Korea.
CNN reported early Friday that hackers had stolen more than $6 billion from Binance, with several investigators pointing to North Korea and Chainalysis saying it had high confidence in that attribution.
The outflows were first spotted on Thursday evening, when about $2.8 billion was reported leaving Binance wallets, and Binance founder Changpeng Zhao later said it looked like a hack. Since then, the picture has changed substantially.
What Binance has now confirmed
In an update on its official X account, Binance moved from “investigating reports” to a confirmed incident:
Binance said it is working with law enforcement and blockchain intelligence firms to trace and recover the funds, and told users to rely only on its official channels.
How the attack unfolded, according to investigators
Blockchain intelligence firm TRM Labs said about $6.36 billion was moved from Binance wallets across 10 blockchains on Thursday, most of it within about 20 minutes starting at 4:05 p.m. US Eastern time, or 20:05 UTC. According to CNBC, TRM said the attack showed preparation well before the theft, including transaction signatures obtained in advance.
That fits Binance’s own account: the attacker did not need the wallets’ private keys, because access to the internal withdrawal system was enough to push transfers out.
Why investigators point to North Korea
TRM attributes the attack to TraderTraitor, a North Korean state-sponsored hacking group. The FBI named the same group as responsible for the $1.5 billion theft from Bybit in February 2025. Chainalysis chief executive Jonathan Levin also said the firm assessed TraderTraitor as the likely culprit, citing links to earlier attacks. North Korea has previously denied hacking crypto exchanges, Axios noted.
The method points in the same direction. Two days before the theft, on October 27, Binance said it had blocked a week of North Korea-linked attacks from a campaign known as Contagious Interview, which uses fake job interviews to trick developers into running malicious code on their machines. Binance has not said whether the compromised engineer’s laptop is connected to that campaign.
If the estimates hold, the theft is more than four times the size of the previous record:
Binance, October 2026 · about $6.3B
Bybit, February 2025 · about $1.5B
Ronin Network, March 2022 · about $620M
Where the money is now
About half of the stolen funds are frozen, mostly stablecoins whose issuers can block their own tokens. The rest is harder to reach. CoinDesk reported that the hacker had split about $1.4 billion in bitcoin across 19 wallets, an asset no issuer can freeze. A Pangolin Intelligence analyst told CNN that “the cat and mouse game has barely begun,” expecting North Korea to tap money-laundering networks to cash out.
Binance says users will not bear the losses, and its next disclosures will be the updated Proof of Reserves and the post-mortem. How quickly it reopens withdrawals, and how much of the unfrozen $3 billion investigators recover, are the open questions.
This is a developing story. Last updated: October 30, 2026.
Kosta has reported on cryptocurrency markets and blockchain infrastructure since 2020, bringing over six years of hands-on experience in the crypto industry built through daily tracking of markets, trends, and emerging blockchain developments. Specializing in Bitcoin on-chain analysis, institutional ETF flows, and digital asset price action, his work at Coindoo has been cited by other news agencies and consistently covers market developments with a focus on data-driven reporting across Bitcoin, Ethereum, Solana, and XRP. Over the years, Kosta has contributed to multiple crypto media outlets in different regions, authoring over 6,000 articles across the sector. His reporting spans cryptocurrency markets and the broader fintech industry, tracking not only price action but also the technological and regulatory forces shaping the ecosystem. To support his analysis, Kosta actively leverages on-chain data and metrics from leading platforms such as Santiment, Glassnode, and CryptoQuant, enabling deeper, evidence-based market insights. He believes in the power of transparency and the data that underpins the blockchain ecosystem. His academic background in Marketing Management from Denmark further complements his analytical approach, adding a strong understanding of communication strategy and content positioning to his work.
