Binance Hack: $6.3 Billion Stolen in Record Crypto Heist
North Korean hackers stole $6.3 billion from Binance in crypto’s biggest heist. See how it happened, what’s frozen, and what it means for your funds.
Raja Awais Ali
11/11/20264 min read
Binance Hack: $6.3 Billion Stolen in Record Crypto Heist Blamed on North Korea
A $6.3 billion theft from Binance, the world’s largest cryptocurrency exchange, has renewed scrutiny of a long-standing weakness in the industry. Hackers may need to compromise only one employee to get inside, and inconsistent security practices can then turn that foothold into a massive loss.
The attack took place on October 29. Binance’s initial investigation found that it followed months of planning but unfolded within minutes. Blockchain analytics firm TRM Labs said the attackers moved about $6.36 billion out of Binance wallets across ten blockchains. Most of it went in roughly 20 minutes, starting at 20:05 UTC, or 5:05 a.m. on Friday in Korea. Binance puts the affected total at about $6.3 billion.
The theft is the largest in crypto history. The previous record was the roughly $1.5 billion stolen from the exchange Bybit in February 2025, which the FBI also attributed to North Korea.
Investigators now say the same actors are behind both attacks. TRM Labs and Chainalysis both linked the Binance breach to TraderTraitor, a North Korean state-backed hacking group. On November 1, the FBI confirmed the attribution, citing “malicious cyber activity” by TraderTraitor. The bureau said the group is mainly converting the stolen assets into ethereum. It expects the group to try moving the funds through decentralised finance platforms and instant-swap services. It has asked exchanges and blockchain analytics firms to block transactions linked to the flagged addresses.
President Donald Trump struck a more cautious note on Saturday. He told reporters that officials were still learning about the case and that it was not certain North Korea was involved, though he did not rule it out. Pyongyang has routinely denied involvement in hacking. The US Treasury sanctioned the related Lazarus Group in 2019, describing it as controlled by North Korea’s main intelligence bureau.
Binance moved quickly to contain the damage. It suspended deposits and withdrawals while it carried out security checks and worked with law enforcement. It said about $3 billion of the stolen assets had been frozen with help from industry partners. TRM Labs estimates the frozen amount at about $2.7 billion, mostly stablecoins held by Tether, Circle, Ripple and World Liberty Financial. Frozen funds are not the same as recovered funds, and returning them can take months.
The exchange also promised that customers would not bear the loss. It said it had set aside more than $6.34 billion in company funds. By Saturday it held enough of the stolen tokens to cover 90% of the missing assets, and by Sunday it said it had replaced 95%. That replenishment is separate from the effort to recover the stolen crypto.
Withdrawals reopened in phases from 06:00 UTC on Sunday, November 1, starting with bitcoin and followed by ether, BNB and some stablecoins. Customers pulled funds out quickly at first. Between 06:00 and 15:30 GMT that day, Binance processed about $4.65 billion in withdrawals against $1.01 billion in deposits, a net outflow of roughly $3.64 billion. Binance said that was about 2.1% of its $171 billion in assets, based on its latest proof-of-reserves data from October 28. Later reports put total withdrawals at $4.72 billion, about 3% of assets. Binance said outflows were stabilising. Crypto prices and related stocks fell after the news broke.
Ari Redbord, TRM Labs’ chief policy officer, described the theft as a bank robbery at the speed of the internet. He said the hackers would likely split the loot into smaller pieces and launder it through smaller exchanges, a process that could take months. But he added that investigators can trace the money in real time, which gives them a chance to disrupt the laundering and seize funds.
Security experts say the case points to a deeper problem than one stolen laptop. Jonathan Alexander, chief technology officer of S&P Global’s OpenZeppelin, said social engineering is a well-known threat. The harder question, he said, is why exchanges lack stronger internal safeguards and circuit breakers that stop an attacker from escalating access once an engineer’s computer is compromised. Binance’s co-CEO Richard Teng said the breach was not a single “one-click” action and that investigators had found additional points of breach.
Alexander also pointed to a cultural barrier. Some crypto advocates see transaction limits and automatic spending reviews as incompatible with blockchain’s decentralised ethos. He called that thinking false and argued that strong security controls and protection against censorship can coexist.
Exchanges are attractive targets because hackers can identify wallets holding vast sums of easily transferable assets and, in some cases, the employees who control them. That makes engineers and IT staff prime targets for elaborate social-engineering campaigns. Alex Pruden, CEO of security firm Project Eleven, said defenders face a basic disadvantage because attackers only need to succeed once. He described the industry as living in constant warfare. He expects the Binance case to push more investment into protecting internal AI tools and agents, which could expand an attacker’s reach if compromised.
Chainalysis data shows more than $22.3 billion has been stolen from crypto platforms since 2021. Following the Binance breach, several exchanges have begun strengthening their defences and sharing more information,
The regulatory picture is fragmented. Unlike banks, US crypto exchanges are not under a single federal cybersecurity regime. Requirements depend on where a company operates and which state licenses it holds. New York has among the toughest rules: its financial regulator requires licensed firms to run cybersecurity programmes, use multi-factor authentication and appoint a chief information security officer.
Elsewhere, companies are mostly covered by state money-transmitter rules. These usually require firms to share cybersecurity information with regulators and undergo examinations, but they rarely prescribe specific technical controls such as encryption standards. Many exchanges operate outside the US and fall outside these regimes altogether. Banks, by contrast, face federal requirements on risk assessment, monitoring and incident response, and the largest ones are examined continuously by dedicated supervisors.
Alexander expects clearer and more standardised cybersecurity expectations, and eventually requirements, to protect investors and rebuild trust. In his view, incidents like the Binance heist show why change is unavoidable.
Stay informed with the latest national and international news.
© 2026. All rights reserved.