Binance Hit by Record $6.3 Billion Hack, Analysts Point to North Korea's TraderTraitor
Binance, the world’s largest cryptocurrency exchange by volume, disclosed on October 30, 2026 that attackers had withdrawn about $6.3 billion in digital assets from its wallets, which would make the incident the largest crypto theft on record. The exchange said an initial investigation pointed to a compromised laptop belonging to a DevOps engineer, which gave the intruder access to a service container from which unauthorized withdrawals were submitted. Binance later said the investigation had found additional points of compromise, and that it has seen no evidence that wallet private keys were leaked. A technical post-mortem has been promised.
Blockchain analytics firms TRM Labs, Elliptic and Chainalysis attribute the attack with high confidence to TraderTraitor, the North Korean group the FBI linked to the February 2025 Bybit theft. TRM reported that on Ethereum the attackers took control of a hot wallet using dozens of pre-signed authorizations, and produced valid signatures on other chains within about half an hour, suggesting a compromise of the exchange’s signing infrastructure. Binance’s co-CEO described the operation as complex and said no individual has yet been held responsible. Risky Business News reported that the FBI has since confirmed North Korea’s role.
Stablecoin issuers and other firms moved quickly to limit the damage: Tether, Circle and several other organizations froze funds, with roughly $2.7 to $3 billion reported frozen. Analysts say the attackers still hold a large amount of Ether and Bitcoin that is likely to be laundered through bridges, swap services and over-the-counter brokers. Binance temporarily suspended deposits and withdrawals, resumed deposits, and said it will cover all losses from its SAFU fund and company reserves while it works with law enforcement.
Help Net Security and Risky Business News also reported on the incident. Figures differ slightly between analytics providers, and details of the intrusion may change as the investigation continues.