North Korea blamed for Binance's ~$6.3B hack, the largest crypto theft on record

What happened? On 29 October 2026, Binance, the world's largest crypto exchange, suffered a security incident with an estimated total impact of about $6.3 billion. That makes it the largest crypto theft on record, far above the roughly $1.5 billion Bybit hack of February 2025. Onchain data showed billions in BTC, ETH, stablecoins and other assets leaving Binance hot wallets across multiple blockchains, most of it within about 20 minutes.

Who did it? Blockchain analytics firm TRM Labs attributes the attack to TraderTraitor, North Korea's top hacking unit, which the FBI blamed for the Bybit hack. TRM traced about $6.36 billion in transfers across ten blockchains, valued at the time each was taken. That includes about $3.79 billion on Ethereum (200,630 ETH, 1.875 billion USDT and 823 million USDC) and 18,270 BTC (about $1.47 billion). TRM says the operation was staged well before the theft, with signatures obtained in advance and executed in one burst.

How did it happen? Binance's initial investigation suggests that a DevOps engineer's compromised laptop let the attacker reach a service container and submit unauthorized withdrawals. It says it has found no evidence of a wallet private key leak and will publish a full technical post-mortem and an updated Proof of Reserves.

Response: About $3 billion has been frozen onchain with partners. Tether froze more than $1.5 billion in USDT, Circle more than $800 million in USDC, and Ripple helped halt about $200 million. Co-founder Yi HeDealroom has a profile for this one. Try Dealroom → said user funds are safe and that Binance will cover all losses from its SAFU fund and company funds. Withdrawals remain paused while Binance rebuilds its withdrawal systems and address controls. On 30 October it said it expected them back within about two days, and deposits are still working (crypto.news). Binance.US says it was not affected.

Fallout: Bitcoin fell more than 4% to below $78,000, BNB dropped more than 5% and Circle shares slid about 5% after hours. CoinDesk reports that institutional investors are rushing to pull assets from centralized exchanges generally, which puts custody risk across the whole sector back in focus.

Sources: Binance: Security Incident Update, TRM Labs, CNBC, CoinDesk, TechCrunch, AP