North Korea Behind $6.3 Billion Binance Hack, FBI Confirms

Attackers drained roughly $6.3 billion from Binance wallets on October 29, and the FBI has now named North Korea as the party responsible. The Binance hack emptied funds across ten blockchains in about twenty minutes, which makes it the largest cryptocurrency theft on record. Binance has since replaced most of the stolen assets with company money, reopened withdrawals in phases, and traced the intrusion back to a compromised employee laptop.

Inside the Record Binance Hack

The unauthorized withdrawals began at roughly 20:05 UTC on October 29, 2026. Blockchain intelligence puts the total at about $6.36 billion across ten chains. Estimates start as low as $5.9 billion, because firms price the stolen tokens at different moments. A single Ethereum transaction emptied one hot wallet holding around 1.6 billion USDT.

The scale dwarfs every previous incident in the sector. February 2025 produced the $1.5 billion Bybit theft, which held the record until last week, and the Binance hack came in at roughly four times that figure. Cold storage stayed untouched, and the money came out of the exchange’s own hot wallets rather than customer balances.

Binance halted trading within hours, suspended deposits and withdrawals, and revoked authorizations for the affected address. Stablecoin issuers did much of the containment work, with Tether freezing over $1.5 billion in USDT and Circle freezing around 800 million USDC. Roughly $3 billion now sits frozen on-chain.

How One Laptop Led to the Binance Hack

Binance published its first incident update at 02:23 UTC on October 30. It named a compromised DevOps engineer’s laptop as the likely entry point. That access opened a route into an internal service container able to submit withdrawal transactions. The exchange found no evidence of a leaked wallet private key, so the fraudulent transfers carried valid signatures and moved through infrastructure behaving as designed.

Co-CEO Richard Teng complicated the picture a day later. He said the attacker did not simply borrow one engineer’s permissions, and that no single one-click action explained the theft. Binance also disclosed additional points of breach, so the laptop reads as the first thread rather than the full account. How the device itself fell remains undisclosed.

The Binance hack follows a pattern now common to large exchange thefts. Attackers skip the cryptography because they do not need it. They go after the people, vendors, and internal systems sitting upstream of asigning decision, and the victim’s own controls then approve the transfer. Bybit followed identical logic, starting from a compromised developer at the Safe{Wallet} platform.

The FBI Points to North Korea

The FBI published an alert on October 31 naming North Korea as responsible for the theft of more than $6 billion in virtual assets from Binance. The bureau tied the operation to TraderTraitor, the same state-sponsored unit it named for Bybit. Investigators have already watched the actors convert the proceeds mainly into Ethereum, and they expect laundering to continue in stages.

The alert came with a list of suspected addresses. The FBI asked virtual asset service providers to block any transactions touching them, and the US Secret Service is working the recovery effort too. Analysts expect the attackers to break the funds into smaller parcels and move them through minor exchanges over months.

A Long Record of Crypto Theft

TraderTraitor sits under North Korea’s Reconnaissance General Bureau alongside units such as APT38 and AppleJeus. Its attributed haul includes $1.5 billion from Bybit, roughly $620 million from the Ronin Network bridge in 2022, and $308 million from DMM Bitcoin in 2024. One long-running technique is Operation DreamJob, where operators pose as recruiters and approach crypto staff with fake job offers that deliver malware.

The volume behind those operations has climbed year on year. Analytics firms had linked more than $2 billion in stolen crypto to North Korea by early October 2025, spread across Bybit and thirty-odd other incidents. At $6.3 billion in one operation, the Binance hack tripled that annual figure inside twenty minutes.

Binance Covers the Losses

Binance committed early to absorbing the full cost of the hack. The exchange said on October 31 that it had replaced about 90% of the stolen assets with new tokens bought using company money. The remaining 10% sits in less liquid tokens that take longer to acquire. Binance also ring-fenced roughly $6.34 billion of its own funds to cover the shortfall.

Four sources funded that response: the Secure Asset Fund for Users, the Futures Insurance Fund, the company’s bitcoin reserve, and its corporate treasury. Teng stated plainly that Binance would absorb the impact rather than pass it to users. Co-CEO Yi He indicated that annual revenue would comfortably carry the hit.

Withdrawals Reopen and Users Head for the Exit

Three days after the Binance hack, phased withdrawals restarted at 6:00 UTC on November 1. Binance prioritised the assets in highest demand over the previous week. Bitcoin, Ethereum, BNB, XRP, Base, Doge and Optimism returned first, and further networks followed as security checks cleared. Binance warned users to expect delays while traffic stayed heavy.

Users moved money off the platform fast once the gates opened. Binance processed $4.6 billion in withdrawals against $1.0 billion in deposits that day, a net outflow of $3.64 billion, or 2.1% of assets under management. Changpeng Zhao noted that most of it landed in the first couple of hours, and that 98% of users chose to stay.

Fiat access widened on November 2, when five more currencies joined the withdrawable list and brought the total to 28. A fresh proof-of-reserves snapshot followed the same day. Users can now verify that platform assets remain backed at a minimum one-to-one ratio.

Scammers Follow the Binance Hack

A second wave of fraud arrived almost immediately, aimed at users rattled by the withdrawal freeze. Fake posts and doctored screenshots on social media claim Binance is paying a $150 compensation reward to affected customers. Zhao warned about the surge on November 2.

The confusion plays directly into the scammers’ hands. Withdrawals paused and then reopened network by network, so users have no clear baseline for what counts as legitimate communication. No exchange pays compensation through an unsolicited social post. Any message promising a payout in return for a login, a seed phrase, or a wallet connection is fraudulent.

What the Binance Hack Changes for Exchange Security

The uncomfortable part of this incident has nothing to do with cryptography. Binance kept its keys secret, its signing process worked, and every stolen transaction validated correctly. An engineering endpoint with a route to production turned out to be worth $6.3 billion. That same path shape exists at plenty of organisations that have never tested for it.

For security teams, the work sits in access design rather than wallet architecture. Developer and operations endpoints deserve treatment as production assets, with hardware-backed authentication and tight session controls. Withdrawal pipelines also need out-of-band approval that a compromised container cannot satisfy alone.

The recovery effort will run for months, and the outcome is far from settled. A published blocklist, $3 billion frozen, and a coordinated tracing effort give investigators more leverage than they had after Bybit. These operators have laundered large sums before, though, and they work patiently. For ordinary users, the Binance hack makes a narrower point: few exchanges hold reserves anywhere near the size that covered this loss, so long-term holdings belong in self-custody.