Science & Tech · Cybersecurity · 3 hrs ago
Binance hit by $6.3bn crypto theft as North Korean link is suspected
About $6.3bn in cryptocurrency was stolen from Binance, the world’s largest crypto exchange.
Analysts at TRM Labs attributed the theft to TraderTraitor, an elite North Korean hacking unit also known as Lazarus, but that link has not been officially confirmed.
North Korea has been accused of stealing cryptocurrency since 2017 to earn money for its military and nuclear weapons programme.
A UN panel said it was reviewing 58 suspected attacks on crypto-related companies from 2017 to 2023, worth an estimated $3bn.
Those thefts may provide half of North Korea’s foreign currency income, according to the panel’s estimate.
Binance temporarily stopped deposits and withdrawals, said it would cover losses and said user funds were safe; some stolen assets have also been frozen.
The suspected theft highlights how crypto hacks may help fund North Korea’s weapons programmes, while the Binance case’s attribution remains unconfirmed.
Binance was hit by a cryptocurrency theft worth about $6.3 billion, the largest reported crypto heist.
The attack began on the evening of 29 October, and most of the funds were moved in about 20 minutes.
TRM Labs attributed the attack to TraderTraitor, a North Korean-linked hacking group, but the link has not been officially confirmed.
Binance said its early investigation pointed to an engineer’s compromised laptop and said it had found no evidence that transaction-authorising private keys were stolen.
Tether and Circle froze billions of dollars’ worth of stolen coins, while Binance said it would cover users’ losses.
- Who
- Binance was the target. TRM Labs suspects the North Korean-linked group TraderTraitor.
- What
- About $6.3 billion in cryptocurrency was stolen. Binance said it would cover users’ losses.
- When
- The attack began on the evening of 29 October 2026.
- Where
- Binance’s cryptocurrency exchange and wallets.
- Why
- Not stated
TRM Labs
Binance and authorities
Attribution
TRM Labs
TRM Labs attributed the attack to TraderTraitor, a North Korean hacking unit.
Binance and authorities
Binance did not name a culprit, and no authority had officially confirmed the attribution.
The attack began, with $6.36 billion in cryptocurrency moved from Binance wallets in a coordinated operation.
Most of the stolen funds had been moved.
Binance said early investigations pointed to a compromised engineer’s laptop and said it would cover users’ losses.
Bitcoin fell by more than 3% at one point and briefly dropped below $77,000, according to BILD.
- Reported theft
- About $6.3 billion; New Scientist reported $6.36 billion
- Attack duration
- Most of the funds were moved in about 20 minutes
- Suspected group
- TraderTraitor, also known as the Lazarus Group
- Frozen funds
- Tether froze more than $1.5 billion; Circle froze $800 million
- Funds still accessible
- TRM Labs said attackers retained access to about $2.4 billion in Ether and Bitcoin
11 sources
Binanceの約1兆円流出、北朝鮮ハッカー集団「TraderTraitor」の犯行か
« La cryptomonnaie n’est pas un gage de sécurité » : un expert décrypte le vol record de 6,3 milliards de dollars contre la plateforme Binance
Ataque hacker à Binance: como a Coreia do Norte virou 'vilã' dos ataques cibernéticos?
How crypto hacking funds isolated North Korea’s nuclear programme
Wat leren we van de grootste cryptoroof ooit? 'Hou je mond over wat je bezit'
Weltgrösste Kryptobörse – Wie konnten die Täter den Binance-Raub durchführen?
Zit Noord-Korea achter de 'grootste cryptoroof ooit'? En vier andere vragen
(S+) Binance: Hacker plündern Kryptomilliarden – und Kim Jong Un könnte der Auftraggeber sein
How did the biggest crypto heist in history just happen?
Sechs Milliarden Dollar in 20 Minuten weg: Fette Beute für Nordkorea-Kim nach Krypto-Raub?
Binance freezes assets after US$6.3 billion heist
What people are saying
Over the last decade, hackers have walked off with nine- or 10-figure sums from crypto hacks on more than 30 occasions. The number of traditional banks who have suffered a loss of more than $100m as a result of a cyber-attack in the same period is zero or one
It shouldn’t be possible for a single [developer] PC to be compromised and somehow for that to allow the entire exchange to be compromised
You can build a vault with mathematical firewalls, but if the individual holding the keys can be duped, the vault is opened
Binance is such a giant in the crypto sector that any loss of trust also affects confidence in the industry as a whole
Posts on X
Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach. This was a complex attack, and we are doing all we can in coordination
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private