Binance Hack: $6.3B Taken in Record Theft Tied to North Korea

What happened

Binance, the world’s largest cryptocurrency exchange, lost about $6.3 billion in a hack that began late Thursday, Oct. 29. Blockchain analytics firm TRM Labs says the money left Binance wallets on 10 different blockchains, and most of it moved within roughly 20 minutes. That makes the Binance hack the biggest crypto theft on record, Reuters reports.

By Friday, two of the best-known blockchain tracing firms, TRM Labs and Chainalysis, said they believed a North Korean hacking group called TraderTraitor was behind it. TRM said it reached that view “with high confidence,” the Associated Press reports. No government agency had formally attributed the attack as of Friday, and North Korea routinely denies these accusations.

Binance paused withdrawals, said customer money is safe and promised to cover all losses out of its own funds. Deposits were briefly paused too, but Binance said they were running normally again by Friday morning.

How the attack worked, as far as we know

Binance hasn’t published its full findings yet, but its early statements and outside analysts sketch the outline.

• A compromised work laptop. Binance said its first look pointed to the laptop of a DevOps engineer, someone who manages the company’s technical systems. That access may have let the attacker submit withdrawals the company never authorized, according to Cointelegraph’s running coverage.
• More than one way in. Hours later, Binance said investigators had found “additional points of breach.”
• No leaked keys, Binance says. The exchange said it found no evidence that a wallet private key, the secret code that controls a crypto wallet, had leaked. Not everyone agrees: former Mt. Gox chief Mark Karpelès told Reuters he thinks attackers probably reached keys for at least two wallets.
• Not a single click. Co-CEO Richard Teng described a multistep intrusion and said no individual employee had been blamed.

TRM’s summary is the simplest version: the attackers gained the power to tell Binance’s own wallets to send money to wallets they controlled. TRM says that mirrors the 2025 Bybit heist.

A quick term: a “hot wallet” is one kept online so an exchange can process withdrawals quickly. It’s convenient, but it’s the kind of wallet hackers target. Kok Tin Gan, who runs the security firm NyxLab, told AP the attacker may have obtained a full-access token to a hot wallet that never expired. That is his reading, not a confirmed finding.

Who is TraderTraitor?

TraderTraitor is the name researchers use for a North Korean hacking unit focused on crypto. The FBI blamed it for the theft of $1.5 billion from the Bybit exchange in February 2025. TRM says this attack shares features with that one, and on-chain sleuth ZachXBT said some of the stolen Binance funds were mixed with money from a separate exploit at the Bitget exchange.

Experts say North Korea steals crypto to bring in foreign currency for its economy and its nuclear weapons program despite United Nations sanctions, according to AP.

The numbers

Some simple math puts this in perspective:

• About four times the old record. At roughly $6.3 billion, this is a little more than four times the $1.5 billion taken from Bybit.
• More than a full year of hacks. TRM counted $2.9 billion stolen across nearly 150 crypto attacks last year. This single theft is more than twice that.
• A small slice of Binance. $6.3 billion is about 3.9% of the roughly $162.8 billion in customer assets Binance reported for 2025.

Why so much was frozen so fast

A big share of the frozen money was in stablecoins, digital tokens pegged to the dollar. Unlike most cryptocurrencies, stablecoins have a company behind them that can block specific tokens from moving. Tether and Circle together froze roughly $2.4 billion, Reuters reports, and others pitched in, including World Liberty Financial and, reportedly, Ripple. Bitcoin and many other coins have no central issuer with that power. Binance hasn’t said what became of the other roughly $3.3 billion.

How markets reacted

Crypto prices slid. Bitcoin fell to $76,368, its lowest in six weeks, and ether hit a two-month low of $2,178, according to Reuters. Binance’s own token, BNB, dropped 5% over 24 hours to $709.70. Reuters notes the market was already under pressure from higher U.S. interest rates and weaker demand for crypto ETFs.

The bigger question is trust. Tim Sun of HashKey told Reuters investors may rethink how safe centralized exchanges are, where a company holds customers’ coins for them.

What happens next

• Withdrawals: Binance said Friday morning it was on track to reopen them in about 45 hours, which points to early Sunday, Nov. 1, UTC.
• Repayment: Binance says about $5 billion of the money it set aside was already held in the same tokens that were stolen, and it is buying the rest. Its separate emergency fund for users, a $1 billion bitcoin reserve, is far smaller than the loss.
• Investigation: Binance plans a full post-mortem and is working with law enforcement. More frozen funds could turn up as tracing continues.

Quick answers

Is my money on Binance safe?

Binance says all user losses will be covered from company funds and that deposits work normally. Withdrawals were paused, with the exchange expecting to restart them within about two days of its Friday update.

Who hacked Binance?

TRM Labs and Chainalysis blame TraderTraitor, a North Korean group. Binance itself hasn’t named anyone and says it is working with law enforcement.

Is this the biggest crypto hack ever?

Yes. At about $6.3 billion, it is the largest crypto theft on record, well above the $1.5 billion Bybit hack of 2025.