North Korean hackers have been linked to a record-breaking $6.36 billion cryptocurrency heist targeting Binance, the world’s largest crypto exchange, in a sophisticated cyberattack that has triggered an international recovery effort and renewed concerns over global digital asset security.

Binance was founded by Changpeng Zhao. Photograph Anthony Kwan Bloomberg Getty

Suspected North Korean state-sponsored hackers have been linked to a record-breaking $6.36 billion cryptocurrency theft from Binance, the world’s largest cryptocurrency exchange, in an unprecedented cyberattack that exposed serious vulnerabilities in digital asset security. The massive breach, which occurred on October 29, 2026, saw billions of dollars in cryptocurrency transferred across 10 blockchain networks, with most of the stolen assets moved in approximately 20 minutes.

Blockchain intelligence firm TRM Labs attributed the attack with high confidence to TraderTraitor, an elite North Korean hacking unit associated with the country’s state-sponsored cyber operations. The incident is now considered the largest cryptocurrency theft recorded, surpassing the approximately $1.5 billion stolen from cryptocurrency exchange Bybit in February 2025.

According to TRM Labs, the attackers compromised Binance’s internal wallet infrastructure and gained the ability to authorize unauthorized transactions. Initial investigations pointed to a compromised employee laptop, reportedly belonging to a DevOps engineer, as a possible entry point into the exchange’s systems. Binance co-CEO Richard Teng later described the incident as a complex attack involving malicious software designed to erase evidence and make the investigation more difficult.

The attackers reportedly prepared their operation well before executing the theft. Blockchain investigators identified suspicious preparatory transactions and tests involving attacker-controlled wallets before the actual breach. These activities suggest that the operation was carefully planned rather than an opportunistic attack.

One of the most significant technical elements involved Ethereum’s EIP-7702 mechanism, a feature that allows externally owned accounts to temporarily execute smart contract code through signed authorization. TRM Labs reported that the attackers exploited this mechanism to turn a Binance hot wallet into an attacker-controlled transaction sweeper, allowing them to move digital assets without following the exchange’s usual security procedures.

READ OTHER ARTICLES:

The attack was not limited to Ethereum. Investigators traced unauthorized transfers across 10 blockchain networks, including Bitcoin, Ethereum, Tron, Solana, XRP Ledger, Arbitrum, Avalanche, Optimism, Base and Polygon. The combined value of the assets transferred reached approximately $6.36 billion based on their market prices at the time of the transactions.

Following the breach, the stolen cryptocurrencies were distributed across numerous digital wallets and blockchain networks, complicating efforts to trace and recover the assets. Investigators and cryptocurrency companies immediately began monitoring suspicious transactions and coordinating efforts to prevent the funds from entering illicit financial channels.

A coordinated response involving Binance, blockchain investigators and major cryptocurrency companies resulted in approximately $2.7 billion in digital assets being frozen. Stablecoin issuers, including Tether, Circle and Ripple, participated in efforts to restrict the movement of certain assets, while additional restrictions were implemented on the Arbitrum network.

However, freezing stolen cryptocurrency does not necessarily mean that all affected assets have been recovered. Some funds remain beyond the reach of issuers capable of freezing centralized stablecoins, making the recovery operation considerably more complicated.

Meanwhile, Binance announced an important development on October 31, saying it had replenished approximately 90% of the stolen assets. The exchange said it had internally allocated around $6.34 billion in company funds to cover the losses, including a partial deployment of its $1 billion Secure Asset Fund for Users, known as SAFU.

Binance explained that the remaining 10% consisted of less-liquid tokens that could take additional time to obtain in the required quantities. The company also said it had conducted a new snapshot of customer assets as part of its proof-of-reserves process, with the objective of demonstrating that eligible customer holdings remained backed at a minimum one-to-one ratio.

The suspected North Korean connection has also renewed international concerns about the growing role of cryptocurrency theft in financing illicit activities. North Korea has repeatedly been accused by international investigators and cybersecurity organizations of using sophisticated cyber operations to generate revenue despite extensive international economic sanctions.

Cryptocurrency theft has become a particularly attractive method for sanctioned states and criminal networks because digital assets can move across international borders without relying on conventional banking infrastructure. However, blockchain transactions also leave publicly traceable records, allowing specialized investigators to monitor suspicious movements and identify connections between digital wallets.

Previous investigations by international authorities have linked North Korean cyber operations to cryptocurrency thefts believed to generate funds for the country’s weapons and ballistic missile programs. Nevertheless, the specific destination of the money stolen in the Binance incident has not been independently established.

Despite TRM Labs’ high-confidence attribution to TraderTraitor, Binance has not publicly confirmed the identity of the attackers. The investigation remains ongoing, and the attribution should not be treated as a formal finding by law enforcement.

The unprecedented Binance breach highlights the growing cybersecurity risks facing the global cryptocurrency industry. It also raises difficult questions about the protection of digital assets, the security of internal transaction authorization systems and the ability of even the world’s largest cryptocurrency exchanges to defend themselves against highly sophisticated cyber operations.

With billions of dollars involved, the incident could become a defining moment for cryptocurrency security, potentially prompting exchanges worldwide to strengthen their internal controls, improve employee cybersecurity protections and reconsider how their most valuable digital assets are stored and authorized.

Binance Faces Historic $6.3 Billion Hack as North Korea Suspected

The cryptocurrency industry is facing one of its most serious security crises after Binance, the world’s largest cryptocurrency exchange, suffered a reported $6.3 billion cyber heist allegedly orchestrated by North Korean state-sponsored hackers. The unprecedented attack has triggered an international investigation, massive efforts to freeze stolen digital assets and renewed concerns about the safety of cryptocurrency platforms worldwide.

The incident, which occurred late Thursday, October 29, 2026, has been described by cybersecurity specialists as one of the largest financial thefts ever recorded. Investigators believe the operation was carried out by TraderTraitor, a sophisticated hacking group linked to North Korea, although the investigation into the perpetrators remains ongoing.

The scale of the incident has raised alarm among cryptocurrency investors, financial institutions and cybersecurity experts, particularly because of the speed and complexity with which the attackers reportedly transferred billions of dollars in digital assets.

Blockchain intelligence companies TRM Labs, Elliptic and Chainalysis have independently pointed to North Korean involvement. Their investigations have identified similarities between the Binance incident and previous cryptocurrency thefts attributed to Pyongyang’s state-sponsored cyber operations.

Tom Robinson, chief scientist at cryptocurrency analytics firm Elliptic, described the incident as potentially the largest theft in history, emphasizing the extraordinary value of the assets involved.

The investigation suggests that the attackers may have initially gained access to Binance’s internal systems through a compromised laptop belonging to one of the exchange’s engineers. The security breach reportedly provided an entry point that allowed unauthorized access to critical infrastructure and ultimately enabled the attackers to execute fraudulent withdrawals.

Binance later indicated that the incident involved additional points of compromise, suggesting that the operation was more extensive than initially understood.

The attack has placed renewed attention on the security of centralized cryptocurrency exchanges, which hold enormous amounts of digital assets on behalf of millions of customers. Binance reportedly serves approximately 335 million registered users worldwide, making the platform one of the most influential players in the global digital currency market.

Despite the scale of the breach, Binance moved quickly to reassure customers that their investments would not be abandoned. Co-CEO Richard Teng publicly stated that the company would cover all customer losses and had allocated approximately $6.34 billion to address the stolen assets.

“Bottom line – your money is safe, and we’re covering every loss,” Teng said, emphasizing the company’s commitment to protecting its customers.

As part of its emergency response, Binance temporarily suspended deposits and withdrawals while security specialists examined the affected systems, strengthened wallet infrastructure and coordinated with international law enforcement agencies.

The company also began working with cryptocurrency security firms and digital asset issuers to trace the stolen funds and prevent further unauthorized transfers.

Among the organizations involved in the recovery operation were Tether and Circle, two major issuers of dollar-pegged stablecoins. Tether reportedly froze approximately $1.57 billion in assets connected to the incident, while Circle restricted more than $800 million.

Additional efforts involved blockchain networks, cryptocurrency custodians and international investigators. The combined response helped prevent billions of dollars in potentially stolen assets from moving freely through the cryptocurrency ecosystem.

The FBI and the United States Secret Service were also involved in efforts to investigate the incident and track the movement of the stolen digital currencies.

The financial markets reacted quickly to news of the breach. Bitcoin, the world’s largest cryptocurrency by market capitalization, reportedly dropped approximately 5% in early Asian trading, reaching $77,380 and marking its lowest level in six weeks.

Market analysts warned that the attack could weaken investor confidence in centralized cryptocurrency exchanges, particularly at a time when digital assets were already experiencing pressure from higher interest rates and changing investment demand.

Tim Sun, a senior researcher at Hong Kong-based HashKey Group, warned that the incident could further discourage investors from holding substantial amounts of cryptocurrency on centralized platforms.

Former Binance chief executive Changpeng Zhao also addressed the incident through social media, assuring users that their funds were safe. Although he no longer manages the exchange, Zhao expressed confidence that Binance would fully compensate affected customers.

The suspected North Korean connection has further intensified international concerns about the country’s growing involvement in cryptocurrency-related cybercrime.

North Korea has repeatedly been accused by the United States and international cybersecurity investigators of conducting sophisticated hacking operations to obtain foreign currency and circumvent economic sanctions.

According to Elliptic, North Korean-linked cybercriminal operations have stolen more than $6.5 billion in cryptocurrency over recent years, including more than $1 billion during 2026. These digital thefts have become an important source of illicit revenue for a country facing extensive international restrictions on its financial activities.

Cryptocurrencies are particularly attractive to criminal networks because digital assets can be transferred across borders rapidly, making them potential instruments for circumventing conventional financial controls. However, blockchain transactions also leave digital records that specialized investigators can analyze to identify suspicious movements and trace stolen funds.

The Binance incident is part of a growing series of major cryptocurrency security breaches that have exposed weaknesses across the industry. According to TRM, approximately $2.9 billion in cryptocurrency was stolen through nearly 150 attacks during the previous year, demonstrating the continuing threat posed by organized cybercriminal networks.

Other cryptocurrency companies have also experienced significant security incidents, including Bitget, which previously reported approximately $350 million in stolen digital assets.

The consequences of the Binance breach are also attracting attention from financial regulators outside the United States. In the United Kingdom, the Financial Conduct Authority and the Bank of England are monitoring the situation for possible effects on financial institutions and businesses with exposure to the cryptocurrency exchange.

Although Binance is not registered with the FCA to provide cryptocurrency services in the UK, the regulator confirmed that it was aware of the reported incident and was engaging with the company to understand its potential impact.

Meanwhile, Binance.US, which operates separately from the global Binance exchange, said its platform was not affected. Coinbase also confirmed that it was not impacted by the breach and was monitoring developments.

The incident involving Binance comes amid growing scrutiny of the cryptocurrency industry’s ability to protect customer funds against increasingly sophisticated cyberattacks. For investors, the unprecedented theft serves as a reminder that even the world’s largest digital asset platforms remain vulnerable to security failures.

As international investigators continue tracing the stolen cryptocurrency, the industry’s response could influence future cybersecurity standards, regulatory oversight and investor confidence in digital financial markets.

Sources : Reuters & AP News &news AU

ADS