North Korea-Linked Hackers Suspected of Stealing $6.3 Billion in Record Binance Cyberattack

A massive cyberattack targeting Binance, the world’s largest cryptocurrency exchange, has resulted in approximately $6.3 billion worth of cryptocurrency being transferred out of its wallets, with blockchain intelligence firms pointing to suspected involvement by North Korean state-linked hackers.

The attack, which took place on Thursday, 29 October 2026, affected Binance wallets across multiple blockchain networks. Investigators believe the operation was carried out by TraderTraitor, a North Korean hacking unit associated with the notorious Lazarus Group.

According to blockchain analysis, approximately $6.36 billion in cryptocurrency was moved from Binance-controlled wallets into addresses controlled by the attackers. A substantial portion of the stolen assets was transferred within approximately 20 minutes, making the incident potentially the largest cryptocurrency theft ever recorded.

How the attack happened

Binance’s initial investigation indicated that the attackers may have gained access through a compromised laptop belonging to a DevOps engineer working for the cryptocurrency exchange.

The compromised device allegedly provided an entry point into one of the company’s internal systems, allowing the attackers to access a service container and initiate unauthorised withdrawal transactions.

Binance subsequently reported that investigators had identified additional points of compromise as the investigation progressed.

Blockchain analysis suggests that the attackers were able to exploit access to Binance’s transaction-signing infrastructure to move funds into wallets under their control.

The operation affected multiple blockchain networks, including Ethereum, Bitcoin, Solana, Tron, XRP Ledger, Avalanche, Polygon, Arbitrum, Optimism, Base and NEAR.

The scale and coordination of the transfers have raised serious concerns about the security of cryptocurrency exchanges and the systems used to authorise transactions.

Billions transferred across multiple networks

Analysis of the transactions indicates that Ethereum accounted for the largest portion of the affected cryptocurrency.

The stolen assets reportedly included approximately:

• $3.8 billion in cryptocurrency on Ethereum.
• 18,270 Bitcoin, valued at approximately $1.48 billion at the time.
• Hundreds of millions of dollars in stablecoins and other digital assets across additional blockchain networks.

The attackers reportedly moved assets through multiple transactions and wallets in an effort to gain control of the funds and make recovery more difficult.

Investigators have also been monitoring attempts to exchange certain stolen tokens for other cryptocurrencies, including Ethereum and Tron-based assets.

Approximately $3 billion frozen

Following the discovery of the attack, Binance began working with cryptocurrency issuers, blockchain intelligence companies, law enforcement agencies and other industry participants to identify and restrict the movement of the stolen assets.

Stablecoin issuers Tether and Circle were among the companies that froze funds associated with the incident.

Tether reported freezing approximately $1.57 billion worth of assets linked to the attack, while Circle froze more than $800 million.

Other cryptocurrency companies also took steps to restrict transactions involving suspected stolen funds.

By Friday, approximately $3 billion of the affected assets had reportedly been located or frozen through cooperation between Binance and its industry partners.

However, billions of dollars remained unaccounted for or outside the reach of freezing mechanisms.

The recovery process remains complicated because certain cryptocurrencies, including Bitcoin and Ethereum, cannot simply be frozen by a central issuing company in the same way that certain stablecoins can.

North Korean hacking group suspected

Blockchain intelligence companies TRM Labs and Chainalysis have independently assessed that the attack was likely carried out by TraderTraitor, a hacking unit linked to North Korea.

TraderTraitor is associated with the Lazarus Group, a North Korean-linked cybercrime organisation that has been connected to numerous major cryptocurrency thefts.

The group has previously been accused of targeting cryptocurrency exchanges, financial institutions and digital asset platforms.

Investigators believe North Korea has increasingly relied on sophisticated cyber operations to obtain foreign currency and cryptocurrency, particularly as international sanctions have restricted the country’s access to conventional financial systems.

Stolen digital assets have previously been linked by international authorities to efforts to generate revenue for North Korea, including funding its weapons programmes.

However, the latest Binance attack has not yet received an official attribution from a government or law enforcement agency. The involvement of North Korean hackers remains an assessment made by blockchain intelligence companies based on the available technical evidence.

Binance responds to the incident

Binance temporarily suspended deposits and withdrawals while its security teams investigated the breach and worked with external partners to prevent further losses.

The exchange reassured customers that their funds were safe and stated that it would cover any losses resulting from the incident.

Binance also confirmed that it was cooperating with law enforcement and cryptocurrency industry partners to trace the stolen assets and identify those responsible.

The company’s investigation had not found evidence that cryptocurrency wallet private keys had been leaked.

The incident has nevertheless raised questions about the security controls used by major cryptocurrency exchanges, particularly the systems and employee access privileges involved in approving large transactions.

A record-breaking cryptocurrency theft

The Binance incident surpasses the February 2025 attack on cryptocurrency exchange Bybit, in which approximately $1.5 billion in digital assets was stolen.

That attack was also attributed to North Korean hackers by the FBI, which identified the TraderTraitor group as responsible.

The latest incident demonstrates the scale of financial damage that sophisticated cybercriminal organisations can cause by targeting vulnerabilities in cryptocurrency infrastructure.

For Binance, the immediate priority is recovering as much of the affected cryptocurrency as possible, completing its investigation and strengthening the security systems that protect customer assets.

The investigation into the $6.3 billion incident remains ongoing.