North Korea linked to the 6.3 billion Binance hack

On 29 October 2026, billions of dollars in crypto moved out of Binance wallets in a short period. The preliminary impact: about 6.3 billion dollars. That is more than four times the 1.5 billion dollar Bybit hack in 2025. Investigators are now connecting the incident to North Korea and an earlier attack on Bitget. Binance says it will cover all losses. But how did this happen, and how much money can still be recovered?

Binance lost 6.3 billion dollars in crypto within minutes

According to blockchain investigation firm TRM Labs, approximately 6.36 billion dollars in digital assets moved out of Binance wallets on 29 October. The assets were spread across ten blockchains, including Bitcoin, Ethereum, Tron, Solana and the XRP Ledger. TRM says most of the transfers happened within about twenty minutes.

The funds were not all in one coin. Investigators counted 18,270 bitcoin, large amounts of ether and billions of dollars in stablecoins such as USDT and USDC. A stablecoin is a crypto asset designed to track a steady value, usually the US dollar.

The 6.3 billion dollar estimate describes the value of assets that moved. The amount that ultimately remains lost depends partly on how much crypto can be frozen or recovered. That distinction matters because billions of dollars in assets have already been blocked.

The evidence points to a North Korean hacking group

TRM Labs attributes the attack to TraderTraitor with a high degree of confidence. US authorities have linked the group to North Korea. Blockchain investigator ZachXBT and Chainalysis have also pointed to links with the group. Investigators rely on blockchain transactions and other intelligence.

One important clue is the connection to the earlier Bitget attack. In September 2026, that incident involved approximately 388 million dollars. According to ZachXBT, funds linked to both incidents eventually converged at the same address after moving through THORChain. This suggests a possible shared actor, but it does not by itself prove that the same people carried out both attacks.

The North Korea link fits an established pattern. The FBI attributed the theft of approximately 1.5 billion dollars from Bybit in February 2025 to TraderTraitor. In another case, the FBI, the US Defense Cyber Crime Center and Japanese police linked the group to the theft of 308 million dollars from DMM Bitcoin in 2024.

The attribution of the new Binance attack comes from investigators, not from a completed criminal investigation. Binance says it is cooperating with law enforcement and has not officially confirmed the attackers’ identities.

A compromised work laptop may have opened the door to wallets

On 30 October, Binance said its initial investigation pointed to a possibly compromised laptop belonging to a DevOps engineer. DevOps staff help build, manage and maintain software systems. Binance said the attacker may have used the laptop to access a service container and submit unauthorised withdrawal instructions. The exchange reported no evidence that wallet private keys had leaked.

TRM describes a technical detail on Ethereum. The attacker allegedly used a feature that allows a wallet to authorise code to run in advance. Prepared authorisations then helped the attacker move funds out of a wallet. On other blockchains, investigators observed ordinary signed transactions. The exact technical reconstruction remains under investigation.

What does that mean? A private key is like the secret key that lets you spend crypto. An attacker does not always need to steal that key directly if they can make a system execute a valid instruction another way. That makes staff security, access controls and transaction approval just as important as the wallet itself.

This is also why a blockchain transaction does not automatically prove that the owner knowingly approved the payment. The transaction can be technically valid even when an attacker has manipulated the instruction behind it.

Partners have frozen billions, but not everything is secured

On 30 October, Binance said about 3 billion dollars in affected assets had been frozen. TRM’s own estimate was about 2.7 billion dollars, including frozen stablecoins and crypto blocked on Arbitrum. The totals differ because investigations are updated at different times and may count different categories of assets.

Tether, Circle and other issuers can freeze certain stablecoins held in wallets they control. The Arbitrum network also intervened in assets on its own network. This does not work for every cryptocurrency. Bitcoin and ether cannot be frozen in the same way by a central issuer.

TRM estimated that, on 30 October, the attacker still held more than 420,000 ether and 18,270 bitcoin, worth about 2.4 billion dollars at the prices then prevailing. That figure changes with market prices and the movement of the coins. Investigators are tracking the flows to prevent the attacker from exchanging or cashing out the assets.

Watch out: Frozen funds are not the same as money already returned to their rightful owners. Freezing can stop certain tokens from moving further, but repayment depends on the investigation and the handling of the case by Binance and the parties involved.

Binance says it will cover all customer losses

Binance says users will not suffer losses from the incident. The exchange has stated that it will cover all losses using its Secure Asset Fund for Users, known as SAFU, and its own company funds. Binance also said it would publish an updated proof of reserves after remediation work is complete.

That is a clear promise from the company, but the process still has to be completed. At the time of the statement, deposits and withdrawals on several networks were temporarily suspended while Binance carried out security checks. The exchange said it had revoked the affected authorisations and was working with law enforcement and blockchain partners to trace the assets.

For customers, the main question is what happens in their own accounts. Binance says customer assets are safe, but users may face temporary disruption while certain services remain suspended. Check updates through Binance’s official channels and ignore messages asking for your recovery phrase or password.

Bitcoin and ether fell after the news

The market reacted quickly. According to The Wall Street Journal, bitcoin fell to around 76,573 dollars during the initial reaction, down 2.9 percent. Ether lost more than 3 percent and traded around 2,186 dollars. Other cryptocurrencies also came under pressure.

Those moves cannot be attributed entirely to the hack. Crypto markets were also dealing with wider concerns about interest rates, bond yields and investors’ appetite for risk. The Binance news added to those concerns. The scale of the incident and the temporary suspension of withdrawals raised questions about the safety of major trading platforms.

In numbers: Suppose you hold 1,000 euros worth of bitcoin. A 2.9 percent price drop reduces its value to about 971 euros. That is a paper loss of 29 euros if you do not sell. This example only shows the effect of that price move and does not predict what the price will do next.

A hack at an exchange does not automatically mean the Bitcoin blockchain itself has been hacked. This incident concerns access to the wallets and systems of a trading platform. The market can still react to confidence in the companies that manage access to crypto.

The damage exceeds the previous Bybit record

Binance’s preliminary estimate of 6.3 billion dollars is about 4.2 times the 1.5 billion dollars stolen from Bybit in February 2025. If TRM’s estimate holds, this is the largest reported crypto theft to date. The final net loss may be lower if more assets are frozen or recovered.

The incident exposes a particular weakness. Even when private keys are not directly leaked, an attacker may use systems and access rights to make a valid transaction happen. The industry’s response will therefore focus not only on finding the coins, but also on staff accounts, pre signed instructions and withdrawal systems.

An earlier BitFox report explains how a hidden chip could attack hardware wallets and why the recovery phrase is so sensitive: A hidden chip stole crypto through Ledger wallets. The attack method is different, but the lesson is similar: security depends on the whole chain, not just one device or password.

Questions to ask

• Is my crypto held on a trading platform or in a wallet whose access I control myself?
• Are withdrawals temporarily suspended, and what does my provider’s official status page say?
• Have I ever shared a recovery phrase, private key or access code with someone I do not trust?
• Do I understand who can freeze, recover or move my crypto if a platform is attacked?

This article provides news and educational context, not financial advice.

Sources

• Binance, Security Incident Update, 30 October 2026
• TRM Labs, North Korea Steals USD 6.36 Billion From Binance, 29 October 2026
• FBI, North Korea Responsible for $1.5 Billion Bybit Hack, 26 February 2025
• FBI, DC3 and Japanese police on the DMM Bitcoin theft, 23 December 2024
• The Wall Street Journal, Cryptocurrencies Slide as News of Major Hack Spooks Markets, 30 October 2026