Hacking News: North Korea Hackers Drain $6.3bn Binance
Meta description: Suspected North Korean hackers drained about $6.3bn from Binance in 20 minutes, the largest crypto theft on record, as the FBI investigates.
Hacking news reached a scale never seen before on Thursday, October 29, 2026, when attackers drained about $6.3 billion in cryptocurrency from Binance, the world’s largest cryptocurrency exchange, in roughly 20 minutes. Blockchain analysts who traced the transfers say the theft is the biggest single heist on record, dwarfing the previous landmark crypto theft and raising urgent questions about how even the largest and best-resourced exchange in the industry could lose control of its own wallets so quickly. The Federal Bureau of Investigation and the United States Secret Service have opened investigations, while Binance and its industry partners have raced to freeze what they can of the stolen funds.
The size of the loss is hard to grasp in ordinary terms. At about $6.36 billion, according to the blockchain intelligence firm TRM Labs, the haul is more than four times the $1.5 billion stolen from the Bybit exchange in February 2025, which had itself been described as a record at the time. British analysts Elliptic went further, calling the Binance incident almost certainly the single largest known theft of any kind, not just in crypto. That framing matters, because it moves the story beyond the usual world of exchange hacks and into the territory of major financial crime, with consequences for markets, regulators and ordinary account holders who had trusted the platform with their assets.
What makes the attack especially alarming is not only its size but its speed and precision. Most of the money moved in about 20 minutes, across ten different blockchain networks, in a sequence that analysts say was automated and carefully prepared. The attackers did not need to break into every wallet one by one. Instead, they appear to have gained control of a system used to authorise transfers, and then used that control to order Binance’s own wallets to empty themselves into accounts they controlled. It was, in effect, a theft carried out with the exchange’s own machinery.
Hacking News: How the $6.3 Billion Moved in 20 Minutes
The timeline pieced together by TRM Labs, Chainalysis and other analysts begins well before the main theft. The firms believe the attackers started preparing at least 36 hours in advance, making small, discreet withdrawals from individual wallets from the morning of Wednesday, October 28, apparently to test the malicious code they would later deploy on a much larger scale. Those test transfers were small enough to pass unnoticed, but they gave the attackers confidence that their method worked and that they could move money without triggering the normal controls.
The main attack began at about 4:05 p.m. Eastern time on Thursday, October 29. Within four minutes, the attackers had moved 233.46 million XRP into their own accounts, according to reporting based on the analysts’ findings. They then took control of Solana and Optimism wallets, and at 4:20 p.m. they removed 18,270 bitcoin. Two minutes later, they made an unauthorised withdrawal of 612.7 million tether, the stablecoin known as USDT. By 4:40 p.m., the total taken had passed $6 billion, after passing $1 billion and then $3 billion in rapid succession as the exchange’s own security team watched the money stream out in real time.
Binance’s own account of the breach points to a compromised laptop belonging to a development and operations engineer. The company said its initial investigation suggested that the security incident may have involved that laptop, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions. The company also said it found no evidence that wallet private keys were compromised, although its investigation uncovered additional potential points of intrusion. That distinction matters for the technical debate that will follow, because it suggests the attackers did not need to steal the deepest secrets of the wallets. They needed only to hijack the approval process that sits in front of them.
Once the funds were out, the attackers moved fast to convert them into a form that would be harder to freeze and trace. Immediately after the theft, they exchanged about $325 million worth of assets for 122,300 ether, paying about $2,650 per ether at a time when ether was trading at $2,300 to $2,350. Paying well above the market price is a classic sign of laundering at speed: the priority is not to get a good deal, but to move the money into a different asset before it can be frozen. They also borrowed 19,760 ether using $60 million worth of stablecoins as collateral, another step that analysts say fits an automated laundering pattern. Some of the funds were also reported to have passed through Tornado Cash, a mixer program often used to obscure the source of funds, which would make tracing the final destination considerably harder.
Cybersecurity News: Why Analysts Blame North Korea
Both TRM Labs and Chainalysis said they had high confidence that the attack was carried out by actors working for North Korea, and TRM Labs identified the group as TraderTraitor. That attribution rests on several strands of evidence, not on a single clue. The firms cited similarities in transaction patterns and methods with previous large thefts blamed on North Korea, including the Bybit theft in February 2025, which the FBI attributed to TraderTraitor. Analysts also found signs that funds from a hack of the Bitget exchange last month had been mixed in with the proceeds of the Binance theft, which they treated as further evidence linking the operation to the same group.
TraderTraitor is linked by American authorities and researchers to the wider Lazarus network, an umbrella term for several North Korean subgroups that operate under the direction of the Reconnaissance General Bureau, the country’s intelligence service. Unlike most state-sponsored hacking groups, which focus mainly on espionage, the Lazarus-linked groups have stood out for more than a decade for profit-driven attacks aimed at stealing funds for the North Korean authorities. That objective, rarely seen among state hackers, is what makes the crypto thefts so distinctive: the money itself is the goal, and it is believed to help fund a regime that is otherwise cut off from much of the global financial system.
North Korea routinely denies such allegations, and it will be important to keep the attribution in its proper terms. The analysts’ assessment is one of high confidence, not of absolute proof in a courtroom sense, and the FBI and Secret Service investigations are still at an early stage. What can be said with confidence is that the pattern matches previous operations, that two independent firms reached the same conclusion, and that American and South Korean authorities have for years described North Korea as using state-linked cyber units for financial theft. The scale of the Binance theft, and the fact that suspected North Korea-linked hackers were responsible for nearly 89 percent of reported crypto hack losses so far this year according to Chainalysis, gives that pattern a weight that goes beyond any single incident.
The attack also fits a wider warning about how North Korean cyber operations are evolving. Microsoft Threat Intelligence warned on Thursday that North Korean cybercriminal groups were increasingly incorporating artificial intelligence into their operations, using it to research potential victims, generate convincing fraudulent identities and scale up phishing campaigns. That does not mean artificial intelligence was used in this specific breach, and no firm has claimed that it was, but it underlines a direction of travel that security teams across the industry will need to take seriously. A group that can automate both the theft and the laundering, as the Binance timeline suggests, is a group that can move faster than human defenders can react.
Data Breach News: Freezes, Cover Funds and Market Shock
In the hours after the theft, the focus shifted to how much of the money could be stopped before it disappeared. Binance said it had worked with industry partners to freeze about $3 billion in affected assets, while TRM Labs put the frozen figure at about $2.7 billion. Tether said it had frozen nearly $1.57 billion, and Circle froze more than $800 million. Those freezes matter because frozen stablecoins cannot be spent, even if they remain technically in the attackers’ wallets, and they represent the main tool the industry has for clawing back funds after a theft of this kind.
Even with those freezes, the attackers still controlled roughly $2.4 billion worth of bitcoin and ether, according to TRM Labs, and the reported total of the heist itself should be treated with some caution. Nearly half of the funds were frozen by various operators, which means those amounts are unusable, but the remainder is still at large and could be moved, mixed or converted over the coming days and weeks. Binance said it had set aside about $6.34 billion of company funds internally to cover the losses, a step designed to reassure customers that their balances would not be wiped out by the theft. On Friday morning, it was not possible for a Binance account holder to transfer cryptocurrencies to another wallet, a freeze expected to last at least 48 hours, although deposits remained possible.
The market reaction was immediate. Bitcoin fell to a six-week low of $76,368, while ether dropped more than 3 percent to a two-month low of $2,178 before markets stabilised. Those moves reflect a loss of confidence as much as a direct financial impact: if the world’s largest exchange can lose $6.3 billion in 20 minutes, investors ask, how safe is any platform? The question is not academic. Last year, attackers stole $2.9 billion worth of cryptocurrency in nearly 150 attacks, according to TRM Labs, and the Binance theft alone is more than double that annual total. For an industry that has spent years arguing that it is maturing into a mainstream financial system, a record heist of this size is a serious setback.
Regulators are also paying close attention. Binance is working with the FBI and the Secret Service, according to a person familiar with the situation, and the FBI said it was aware of the incident and coordinating with public and private partners. An Abu Dhabi regulator is monitoring the fallout, reflecting Binance’s global footprint and the fact that the attack touched wallets and customers across many jurisdictions. That multi-agency, multi-country response will be necessary, because the funds moved across ten blockchains and through mixers and exchanges in different legal systems, and no single authority can follow them alone.
Crypto News: What Happens Next for Binance and Its Users
What happens next will unfold on three tracks at once. The first is the investigation, which will try to establish exactly how the DevOps engineer’s laptop was compromised, how the attackers gained access to the service container, and whether any other points of intrusion remain open. Binance’s statement that no wallet private keys were compromised, if confirmed, will shape the technical lessons, because it would mean the industry’s problem is not only about guarding keys but about guarding the approval systems that sit around them. Other exchanges will be auditing those systems urgently, and regulators will want to know why the controls that were supposed to stop unauthorised withdrawals did not stop this one.
The second track is the recovery effort, which will test whether the freeze strategy can actually return money to victims. Freezing stablecoins is a powerful tool, but it does not recover bitcoin and ether that have already been mixed or converted, and it depends on the cooperation of every operator in the chain. The $2.4 billion still controlled by the attackers is the hard part of that effort, and it may take months of tracing, legal action and international cooperation to recover even a fraction of it. Customers, meanwhile, will be watching closely to see whether Binance’s $6.34 billion cover fund is sufficient and how quickly normal withdrawals resume after the 48-hour freeze.
The third track is the policy debate, which the sheer size of the theft will inevitably accelerate. Crypto news in recent years has been dominated by questions about regulation, custody and security, and a $6.3 billion theft blamed on a state-linked group will give fresh weight to arguments for stricter controls on exchanges, for better protection of approval systems, and for faster cross-border cooperation when stolen funds move. It will also raise uncomfortable questions about attribution and deterrence: if a state can steal billions in minutes and face no immediate consequence beyond frozen stablecoins, what stops it from doing so again?
For now, the facts that matter are clear enough. A record $6.3 billion was taken from Binance in about 20 minutes on October 29. Two leading blockchain firms blame North Korea’s TraderTraitor group with high confidence. About $3 billion has been frozen, about $2.4 billion in bitcoin and ether remains under the attackers’ control, and Binance says it has set aside company funds to cover the loss. The FBI and Secret Service are investigating, markets have steadied after an initial fall, and the industry is left with its largest security failure to date. How it responds, in the coming days and in the reforms that follow, will determine whether this heist is remembered as a one-off catastrophe or as the moment when crypto security had to change for good.
Source: The Washington Post