The Binance crypto heist that struck the world’s largest cryptocurrency exchange on Thursday is now the largest crypto theft on record, with more than $6 billion stolen and investigators pointing the finger at North Korea. Binance put the total impact at around $6.3 billion and said it would cover all losses, insisting that user funds are safe.
FAKTA
- What happened: Hackers stole more than $6 billion in cryptocurrency from Binance wallets on Thursday, 29 October 2026.
- Scale: Binance estimated the total impact at around $6.3 billion; blockchain firm TRM Labs put the amount moved at about $6.36 billion.
- Frozen so far: About $3 billion has been frozen, including $2.3 billion in USDT and USDC stablecoins.
- How it happened: Binance’s initial investigation points to a compromised DevOps engineer’s laptop that gave an attacker access to a service container used to submit unauthorised withdrawals.
- Attribution: TRM Labs, Chainalysis and other investigators attribute the heist to a North Korean hacking unit; the attribution is their assessment, not a confirmed finding by Binance.
- Previous record: The $1.5 billion Bybit hack of February 2025, also blamed on North Korea-linked hackers.
Binance crypto heist: the largest theft of its kind
Binance, the world’s largest crypto exchange by volume, confirmed a security incident on Thursday and temporarily suspended deposits and withdrawals while security checks are completed. The exchange said it had revoked the affected address authorisation and engaged law enforcement and blockchain intelligence partners to trace and recover the funds.
Estimates of the haul vary slightly by firm and method. Binance put the total impact at around $6.3 billion in stolen assets. TRM Labs said an attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC on Thursday. Chainalysis put its estimate at roughly $5.9 billion at the time of the theft. By any of those measures, the theft is about four times the previous record.
According to blockchain data cited by CoinDesk, the hacker’s wallets at one point held more than $5.7 billion in various cryptocurrencies, including nearly $1.5 billion in bitcoin, $900 million in ether, roughly $1.5 billion in USDT and more than $800 million in USDC.
How the attackers got in, according to Binance
Binance said its initial investigation suggests the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions. The exchange said it had found no evidence that wallet private keys were leaked.
The investigation is still under way, and Binance has not yet published a full account of how the laptop was compromised or how the attacker moved from it into the exchange’s systems. Those details matter for other exchanges: if a single engineer’s device can reach a service able to authorise withdrawals, the incident will renew scrutiny of how crypto platforms separate staff devices from the systems that move customer funds.
Investigators blame a North Korean hacking unit
TRM Labs said it attributes the attack to TraderTraitor, an elite North Korean hacking group, based on robust on- and off-chain intelligence, and said it has high confidence in that assessment. Chainalysis told CNN it had high confidence North Korea was behind the hack, and Pangolin Intelligence said it also believed a North Korean hacking unit was responsible. Blockchain investigator ZachXBT pointed to the Lazarus Group, the state-linked hacking squad of which TraderTraitor is described as a subunit.
The attribution has not been confirmed by Binance, and North Korea has previously denied hacking allegations. CNN said it had sought comment from North Korea’s mission to the United Nations, and from the FBI and the US Secret Service. The claim should therefore be read as the investigators’ assessment, while the theft itself and the frozen funds are confirmed by Binance and the firms involved in the recovery effort.
If the attribution holds, the heist would fit a pattern documented by United Nations reports and private firms: North Korea-linked hackers have stolen billions of dollars from banks and cryptocurrency firms in recent years, and US and South Korean officials describe those hacking teams as a key source of revenue for the sanctions-hit regime. The previous record, the $1.5 billion Bybit theft of February 2025, was blamed by the FBI on the same TraderTraitor group.
Markets fall as $3 billion is frozen
The race to freeze the stolen money was under way within hours. Binance said about $3 billion of assets had been frozen in a late Thursday update, including $2.3 billion in USDT and USDC stablecoins, whose issuers can block transfers from affected addresses. Tether said it had frozen more than $1.57 billion in USDT, and Circle said it had frozen more than $800 million in USDC.
That still leaves roughly $3 billion outstanding, with Chainalysis monitoring stolen funds moving across multiple blockchains, including bitcoin and ethereum. Attackers in such cases typically try to swap freezable stablecoins for cryptocurrencies that lack central issuer controls, using decentralised exchanges and lenders — a process investigators described as a cat-and-mouse game that has barely begun.
Crypto prices fell sharply on the news. Bitcoin dropped 4.8 percent to below $77,000, ether fell 5.7 percent, and BNB, the native token of the Binance-linked BNB Chain, fell 8 percent, according to CoinDesk. The wider market sell-off on Friday also reflected broader nerves about heavy spending by technology giants, but the hack added a sharp shock of its own to crypto markets.
What Binance says to its users
Binance co-chief executive Yi He said in a post on X that the platform would cover all hacking losses. Binance said it would cover losses from its own funds and an emergency assets fund, reiterating that user funds are safe. Its Secure Asset Fund for Users, set up in 2018 to protect customers during security breaches, holds roughly $1 billion in bitcoin, according to CoinDesk.
Founder Changpeng Zhao, who no longer leads the exchange but remains its largest shareholder, wrote that it does look like a hack on Binance, and that as a shareholder he expects all user funds to be fully covered. Withdrawals will stay suspended until the exchange’s security checks are complete, and Binance has not yet said when they will resume.
For users, the immediate questions are practical: when withdrawals reopen, whether any further funds are recovered, and what Binance’s final investigation finds about how the breach happened. For the wider crypto industry, the heist — four times the previous record — is a reminder that the largest platforms remain the largest targets. Read more in our Technology section.
