North Korean state-backed hackers likely stole between $6.3 billion and $6.43 billion from Binance on October 29, 2026, in what blockchain analytics firms describe as the largest single theft in history, the BBC reported. The Lazarus Group, also known as TraderTraitor, has been identified as the culprit with “high confidence” by TRM Labs, Chainalysis, and Elliptic. Tom Robinson, chief scientist at crypto consultancy Elliptic, stated, “This is almost certainly the largest theft of any kind in history.”
Binance recovers $3 billion in frozen assets
Binance has estimated the total impact of the breach at approximately $6.3 billion, while Elliptic’s analysis puts the figure higher at $6.43 billion. The exchange has worked with blockchain partners to freeze roughly $3 billion of the affected assets on-chain, according to a Binance announcement.
User funds are safe. Binance will cover all hacking losses.Deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement.We will share a full post-mortem once the investigation is complete. Please…
Elliptic verified $2.84 billion of those frozen funds, noting that most consist of USDT and USDC. The attacker is currently swapping remaining assets into Ethereum (ETH) and other non-freezable assets to move them across different blockchains. Elliptic reports the attacker now controls about $3.23 billion in assets that cannot be frozen by an issuer.
Did you know? The Binance theft is more than six times larger than the previous record for any kind of theft: $1 billion taken from the Central Bank of Iraq by Saddam Hussein in 2003, according to Elliptic.
Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.The company has already publicly committed to cover losses through… pic.twitter.com/UqtBd37Fpj
Attackers manipulated Binance systems via multiple breaches
Binance initially reported that the breach involved a compromised DevOps engineer’s laptop, which allowed an attacker to access a service container and submit unauthorized withdrawals. However, co-CEO Richard Teng later stated that subsequent investigations uncovered “additional points of breach.”
Elliptic’s on-chain evidence suggests the attack was more complex than a single laptop breach and “was not carried out by one person.” Rather than stealing private keys, the attacker appears to have manipulated Binance’s own systems to sign transactions on their behalf. TRM Labs stated the attacker likely gained access to the hot wallet signing system.
Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach. This was a complex attack, and we are doing all we can in coordination… pic.twitter.com/FQQ3vKT6GU
FBI links cybercrime activities to North Korea
The FBI and various intelligence firms link these activities to North Korea, which the FBI accuses of “illicit cybercrime and virtual asset theft activities.” Reports indicate the nation recruits top university students for hacker groups overseen by its intelligence agency, sometimes operating out of China.
The scale of the Binance heist follows a pattern of escalating thefts. United Nations and private firm reports indicate Pyongyang-linked hackers have stolen billions from cryptocurrency firms and banks over the last several years. Previous suspected activity includes a 2014 hack of Sony Pictures, the studio behind the film The Interview.
Arbitrum Security Council has executed a transaction to freeze ~$30.5M from the Binance Exploit. Thanks to all other signers involved. 💛
| Target | Estimated Loss | Year |
|---|---|---|
| Binance | $6.3B – $6.43B | 2026 |
| Bybit | $1.5B | 2025 |
| Unnamed Crypto | $620M | 2022 |
Bitcoin prices fall as investors reassess exchange safety
Bitcoin prices fell 5% immediately following the news, reaching a six-week low of $77,380. Tim Sun, a senior researcher at HashKey Group, told the press the breach may prompt investors to reassess the safety of assets held on centralized exchanges.
Chainalysis noted that the attacker used laundering patterns “we have not seen before,” leading some experts to suggest that artificial intelligence may have been used to automate the infiltration of Binance’s systems. Elliptic further confirmed that some stolen funds were laundered alongside proceeds from a September 2026 exploit of Bitget. TRM reported that attackers stole $2.9 billion across nearly 150 attacks last year.
Security Note: Binance stated that user funds are safe and the company will cover all losses using its SAFU fund and company funds.
Binance theft common questions
Are deposits still working on Binance?
Yes. A Binance update on October 30, 2026, clarified that deposits remain unaffected and continue to operate as normal.
How did the hackers bypass security?
While a DevOps engineer’s laptop was an initial entry point, Binance and Elliptic both indicate the attack involved multiple breach points that allowed the attackers to make the system sign transactions automatically.
Who is paying back the stolen user funds?
Binance announced it will cover all losses through its company funds and the Secure Asset Fund for Users (SAFU).
Binance, co-founded in 2017 by Canadian national Changpeng Zhao, became the largest crypto trading platform globally within one year of launching. The exchange is now coordinating with law enforcement partners and the U.S. Attorney’s Office for the District of Columbia to identify the criminals.
An analyst with Pangolin Intelligence told CNN that the “cat and mouse game has barely begun yet,” as North Korea is likely to utilize a network of money laundering organizations to convert the stolen digital assets into hard currency.
@binance Hack: New Clues Point to North Korean HackersNorth Korea is believed to be behind the $6.3 billion hack suffered by Binance on October 29. TRM Labs attributes the attack to the TraderTraitor group with a high level of confidence. Crypto investigator ZachXBT found… pic.twitter.com/vsQqHEjjvP
More on North Korean
Keep reading