North Korean Hackers Behind Record $6.36 Billion Binance Crypto Heist in Largest Cryptocurrency Theft in History

North Korean hackers have been identified by the FBI as responsible for the largest cryptocurrency theft in history, after approximately $6.36 billion in digital assets was stolen from Binance, the world's biggest cryptocurrency exchange, in an unprecedented cyberattack on October 29, 2026. The FBI formally attributed the operation to TraderTraitor, a North Korean hacking group, on October 31, confirming earlier findings by blockchain intelligence firms that had linked the theft to Pyongyang. The amount stolen shattered the previous record set by the $1.5 billion Bybit hack in February 2025, raising fresh concerns about the security of digital assets and the ability of major exchanges to protect enormous concentrations of wealth. The scale of the operation was particularly striking because the attackers reportedly transferred most of the stolen funds in approximately 20 minutes, across ten different blockchains. As investigators race to trace the assets, the incident has reignited questions about the reliability of cryptocurrency platforms and the risks associated with entrusting billions of dollars to systems that remain vulnerable to sophisticated cybercriminals.

The unprecedented theft appears to have exploited weaknesses in Binance's internal security infrastructure rather than a fundamental flaw in the underlying blockchain networks. According to the exchange's preliminary investigation, the attackers may initially have gained access through a compromised laptop belonging to a DevOps engineer, allowing them to interfere with systems responsible for processing cryptocurrency transactions. Binance subsequently acknowledged discovering additional points of compromise, suggesting that the intrusion was more complex than originally believed. Blockchain intelligence firm TRM Labs reported that the attackers moved approximately $6.36 billion from Binance-controlled wallets across ten blockchains, with most of the transfers completed within roughly 20 minutes. The company's assessment connected the operation to TraderTraitor through technical evidence and patterns associated with earlier North Korean cyberattacks. «We make this judgment with high confidence», TRM Labs stated before the FBI publicly confirmed the attribution. The incident exposed the vulnerability of centralized cryptocurrency exchanges, where digital assets may be secured by blockchain technology but remain dependent on employees, connected devices and internal authorization systems that sophisticated attackers can compromise.

So I've always felt it was a little bit dangerous.

The cyberattack also drew a response from Donald Trump, who addressed the record cryptocurrency theft on October 30 while federal investigators were examining whether North Korean hackers were responsible. Asked about the possible involvement of Pyongyang, Trump replied: «We're looking at that.» He also acknowledged his longstanding concerns about the risks of digital financial transactions, remarking: «So I've always felt it was a little bit dangerous.» His comments came one day before the FBI publicly identified TraderTraitor as responsible for stealing more than $6 billion in virtual assets from Binance. Working alongside the U.S. Secret Service and the Internal Revenue Service's Criminal Investigation division, federal authorities reported that the hackers were converting stolen assets primarily into Ethereum and were expected to use decentralized finance platforms and instant-swap services to further disguise their movements. The FBI urged cryptocurrency exchanges, blockchain operators and other digital asset businesses to block transactions associated with identified wallets, highlighting the difficulty of recovering enormous amounts of cryptocurrency once criminals begin moving funds across decentralized financial networks.

In the aftermath of the record-breaking theft, Binance moved to contain the financial damage and reassure customers that their holdings remained protected despite the unprecedented security breach. The cryptocurrency exchange announced that it was working with industry partners to freeze approximately $3 billion in affected assets while using its own financial resources to cover the losses. By November 1, Binance said it had already covered 95% of the stolen assets, although this did not mean that an equivalent amount had necessarily been recovered from the hackers. The exchange also experienced a surge in customer withdrawals after restoring access to several digital assets, providing an immediate indication of how the attack had affected confidence in the platform. A Binance spokesperson acknowledged the initial reaction, explaining: «Withdrawal volumes spiked at the beginning, however we are seeing a sharp downward trend and withdrawal levels are stabilising to what we would consider normal and expected on-chain activity.» The company's assurances have nevertheless placed its security practices under intense scrutiny, particularly given the extraordinary amount of cryptocurrency that attackers were reportedly able to transfer within minutes.

The Binance incident is also part of a broader campaign of cryptocurrency thefts attributed to North Korean cybercriminals, whose operations have become increasingly sophisticated and financially consequential. In February 2025, hackers linked to Pyongyang stole approximately $1.5 billion from the cryptocurrency exchange Bybit, an attack that was considered the industry's largest before the Binance breach. Researchers at TRM Labs estimated that criminals stole another $2.9 billion in cryptocurrency across nearly 150 attacks during 2025, illustrating how digital asset theft has developed into a major international security problem. U.S. officials have repeatedly accused North Korea of using stolen cryptocurrency to obtain foreign currency and help finance activities connected to its military and weapons programs, allegations that Pyongyang has historically denied. The FBI's identification of TraderTraitor in the Binance investigation has renewed attention on those concerns, particularly as investigators track stolen funds moving through cryptocurrency exchanges and decentralized financial services. The challenge extends beyond identifying the perpetrators, because tracing transactions on a public blockchain does not automatically provide authorities with the power to seize or reverse them.

Withdrawal volumes spiked at the beginning, however we are seeing a sharp downward trend and withdrawal levels are stabilising to what we would consider normal and expected on-chain activity.

Beyond the financial losses and international investigation, the largest cryptocurrency theft in history has raised a fundamental question about the industry's future: how much confidence can investors place in digital assets when even the world's largest exchange can suffer a breach of this magnitude? The attack does not establish that Bitcoin, Ethereum or other underlying blockchain networks were themselves compromised. Instead, it exposes the risks associated with centralized exchanges, where customers depend on corporate security systems, employee access controls and connected digital wallets to safeguard their holdings. Unlike conventional banking transactions, cryptocurrency transfers generally cannot be reversed by a central authority, making the recovery of stolen assets particularly difficult once criminals begin moving them through different platforms. The incident has prompted competing exchanges to reassess their security precautions while testing whether Binance can retain customer trust after such an extraordinary loss. As cryptocurrencies become increasingly integrated into mainstream finance, the challenge is no longer simply whether digital transactions can be processed quickly and securely, but whether the institutions managing those assets can provide the protection and accountability expected of a global financial system.

Created by humans, assisted by AI.