Binance Loses $6.3 Billion in Record Crypto Theft; FBI Blames North Korea

1 Nov 2026, 11:36

fercan.yalinkilic

The exchange says customers won’t take the hit and withdrawals are coming back online. The harder question is how a laptop and a hot wallet still opened a door this big.

MoneyTurkey Crypto Desk | 1 November 2026

Key points

About $6.3 billion was drained from Binance hot wallets on 29 October, the largest crypto theft on record, and the FBI blames North Korea’s TraderTraitor/Lazarus group.
Binance says it will absorb the loss, has replenished about 90% of the stolen assets and is restoring withdrawals in stages.

On 29 October someone emptied about $6.3 billion from Binance’s hot wallets. That’s the largest crypto theft on record if the early tallies hold — roughly four times the $1.5 billion taken from Bybit in February 2025. By Saturday the FBI had put a name on it: North Korean state hackers. Binance says it has already topped up about 90% of what was taken with its own money and started turning withdrawals back on.

What happened

TRM Labs watched roughly $6.36 billion leave Binance wallets across 10 chains, most of it in about twenty minutes from 20:05 UTC on the 29th. Chainalysis was in the same ballpark at near $6.4 billion, and said freezes started within about an hour — with around $2.8 billion locked by the time they published.

Binance’s first public line, early on the 30th, pointed at a compromised DevOps laptop: access to a service container, then unauthorized withdrawals. They stressed they hadn’t seen a private-key leak.

Co-CEO Richard Teng later made clear it wasn’t a one-click mess. “To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process,” he said. In a video on X he described a self-destruct wipe on the way out, and use of Ethereum’s EIP-7702 so a hot wallet could be steered without the usual approvals. “This was a complex attack,” he added — investigators had found more than one way in.

On Ethereum, Chainalysis said the attacker funded a wallet through Tornado Cash, got signed authorizations ahead of time, then used those to make a Binance hot wallet run code the attacker had deployed — and sweep itself.

Who’s behind it

On 31 October the FBI said North Korea was responsible for stealing more than $6 billion from Binance on or about 29 October, tying the job to the group it calls TraderTraitor — also known as Lazarus Group and APT38. Working with the Secret Service and IRS Criminal Investigation, the bureau said the hackers were mainly converting stolen assets into ether, then expected to push that through DeFi and instant-swap services. They published addresses and asked node operators and DeFi desks to block them.

Private firms were already leaning the same way. “Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026,” TRM Labs said — small Tornado Cash drips, long staging, signatures banked then fired in one burst. Chainalysis’s strongest tell, in its telling, was Binance funds mixing on-chain with money from last month’s Bitget theft, also blamed on North Korea.

How Binance is covering the losses

Binance says it has lined up more than $6.34 billion — a mix of tokens it already held, plus buys on exchanges and OTC — drawn from SAFU, part of the futures insurance fund, and the corporate treasury. “Binance will absorb the financial impact of these stolen funds, not our users,” the exchange said. Teng on X: “We’ve now replenished 90% of the stolen assets, and we’re committed to covering the remaining 10%.” That last slice is the less liquid names outside the top ten, which take longer to source.

Worth keeping straight: the 90% is money put back behind user balances, not coins clawed back from the thief. Withdrawals came back in stages — bitcoin first, then Ethereum and BNB Smart Chain, according to posts picked up by CNBC.

Analysis

The tape flinched, then steadied. Bitcoin slid about 4% toward $77,400 on the 30th, with an intraday low near $76,200. BNB dropped about 6%. US spot bitcoin ETFs saw roughly $643 million leave that day. There wasn’t a full-blown run: Binance had cash, stablecoin issuers froze around $3 billion, and withdrawals were moving again inside about 72 hours.

The lasting bruise is operational. If the path really ran from an employee device to a hot wallet executing outsider code, the “we’ve solved custody” story at the biggest venues gets harder to tell with a straight face. CoinDesk also noted that some of the compromised wallets had shown up on Binance’s own list of assets backing customer balances — which muddies any clean “house funds only” line. In Washington, the Clarity Act is still stuck in the Senate; a theft this size won’t make that quieter.

What to watch

Monday’s promised proof-of-reserves update (2 November)
Binance’s fuller technical write-up once facts are locked
Whether the stolen ETH trail can still be frozen as it moves through DeFi and swap rails
Fresh political pressure on exchange custody rules

For information only. Not investment advice.

MoneyTurkey

Borsa Istanbul CEO Detained, New SPK Chief Named

Book Pick: Breakneck by Dan Wang

Russia Agrees to Halt Ghanaian Recruitment for Ukraine War

Politics wrap: Russia ends Ghana recruitment for Ukraine war

Bonds wrap: Fitch slaps negative outlook on France