SINGAPORE, October 30, 2026 — Elite hackers linked to North Korea executed the largest cryptocurrency heist in history, draining billions from Binance wallets in twenty minutes. Hackers working for the North Korean regime stole at least $6.3 billion in cryptocurrency from the company’s wallets, according to TechCrunch. The breach is by far the largest known theft of crypto and potentially any financial heist in history, according to TechCrunch and Elliptic.
How the Cyberattack Unfolded
An attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains, mostly in about 20 minutes, according to TRM. In plain terms, think of it like a digital bank vault where the thieves managed to empty the main safe before the security guards even noticed the alarms flashing. Binance said in a post on X that its initial investigation indicated hackers targeted a compromised employee laptop to access a service container and submit unauthorized withdrawal transactions, as reported by TechCrunch. The company later stated that a subsequent investigation uncovered additional points of breach, according to NPR.
Blockchain intelligence firm TRM attributed the attack with high confidence to TraderTraitor, described as North Korea’s elite hacking unit, according to NPR. Chainalysis and Elliptic also concurred that North Korea was likely behind the cyberattack, according to NPR and Yahoo. Jonathan Levin, co-founder and CEO of Chainalysis, wrote on X that the hack was likely done by the Democratic People’s Republic of Korea group TraderTraitor, as reported by NPR. Several features of the attack matched earlier North Korea-linked heists, including a $1.5 billion hit suffered by exchange Bybit in February of the previous year, which the FBI also attributed to North Korea, according to TRM and NPR.
The Industry Response and Asset Freezing
Industry partners, including stablecoin issuers Tether and World Liberty Financial, froze about $3 billion of the stolen funds as they traveled across blockchains, according to TechCrunch and Yahoo. Binance spokesperson Andie Cooper stated that the company began recovering affected assets for users and continued to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds, according to TechCrunch. Binance is working with law enforcement agencies including the Federal Bureau of Investigation and the United States Secret Service, according to Yahoo.
Binance suspended withdrawals while investigating the breach and stated that company funds would cover all user losses, according to NPR and Yahoo. The exchange said customer funds were safe, and set aside around $6.34 billion of company funds internally to cover the losses, according to Yahoo. Binance founder Changpeng Zhao posted on X that the incident looked like a hack on Binance but user funds were safe, according to NPR and Yahoo. Zhao founded Binance in 2017, pleaded guilty in 2023 to a felony linked to failing to prevent money laundering, stepped down as CEO, and was pardoned by U.S. President Donald Trump in 2025, according to NPR and Wikipedia.
Security Questions and Broader Context
The practical upshot for readers watching hardware and exchange security is that Binance will face questions about why the company’s security allowed a single employee’s laptop to access systems capable of controlling billions of dollars in funds, according to TechCrunch. It remains unclear how the hack went down or under what circumstances the employee’s laptop was compromised, though security incidents often stem from compromised software or malware on employee devices, according to TechCrunch. Binance Holdings Ltd., branded Binance, is the largest cryptocurrency exchange in terms of daily trading volume, having moved through China, Japan and Malta before settling without an official company headquarters, according to Wikipedia.
North Korea has for years used state-linked cyber units for espionage, financial theft and revenue, according to United States and South Korean authorities as well as cybersecurity experts cited by Yahoo. Experts state that North Korea has turned to crypto hacking and other illicit cyber activities as a source of badly needed foreign currency to support its troubled economy and fund its nuclear program in the wake of tough United Nations sanctions, according to NPR. In December 2022, South Korea’s spy agency stated that North Korean hackers had stolen an estimated 1.5 trillion won, or $1.1 billion, in cryptocurrency and other virtual assets in the past five years, with North Korea’s digital asset theft capacity considered among the best in the world, according to NPR.
Sources
- North Korean hackers blamed for stealing record $6.3B in Binance breach | TechCrunch
- Blockchain intelligence firms link North Korea to $6.3B hack on Binance
- Hackers steal $6.3 billion from Binance in record heist blamed on North Korea
Photo: Bretwa (CC BY-SA 4.0)
