On 30 October 2026, Binance, the world's largest cryptocurrency exchange, confirmed a security incident with an estimated impact of approximately $6.3 billion in digital assets.
The theft began at around 20:05 UTC on 29 October. Blockchain intelligence firm TRM Labs reported that "an attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains", with most of it moving in roughly twenty minutes.
That makes it the largest cryptocurrency theft on record, about four times the $1.5 billion Bybit hack of February 2025, which held the previous record.
TRM Labs attributes the attack with high confidence to TraderTraitor, North Korea's elite hacking unit, linked to the Lazarus Group. Chainalysis agrees. The FBI named the same group as responsible for Bybit.
Two things need stating immediately, because they change how the story should be read.
The entry point was mundane. According to reporting on Binance's account, an attacker accessed a service container via a compromised DevOps engineer's laptop and submitted unauthorised withdrawals. Binance says it found no evidence of a wallet private key leak.
About half the money has been frozen. Binance confirmed a verified frozen total of approximately $3 billion, and says it will cover all losses using its SAFU fund and company funds.
What happened
The sequence
When | What |
|---|---|
29 October, around 20:05 UTC | Coordinated sweep begins across ten blockchains |
Roughly 20 minutes | The bulk of the funds leave Binance wallets |
29 October, late | Binance discloses a security incident with estimated impact around $6.3 billion |
30 October | TRM Labs and Chainalysis publish attribution to TraderTraitor; token issuers move to lock stolen funds |
30 October | Binance confirms approximately $3 billion frozen |
How they got in
This is the part worth dwelling on, because it is not a cryptography story.
An attacker reached a service container through a compromised DevOps engineer's laptop, then submitted unauthorised withdrawals. TRM Labs' assessment is that the attacker gained the ability to make Binance's hot wallet signing system produce valid signatures across chains.
Note what that means. The signatures were valid. The system did what it was designed to do. Binance's statement that there is no evidence of a private key leak is consistent with this: the attacker did not need the keys, because they reached the system that uses them.
The pattern echoes Bybit. In that case, North Korean operators compromised a developer's computer at Safe, Bybit's wallet infrastructure provider, and an employee unknowingly authorised the command. Different company, same shape: a workstation, then the signing path.
The attribution
TRM Labs attributes the theft to TraderTraitor based on what it describes as robust onchain and offchain intelligence, stating that "several features of this attack match earlier North Korea-linked heists". Chainalysis reached the same conclusion, and reported that its investigators spotted funds from September's Bitget exploit commingling with the Binance loot.
That commingling detail is significant. Mixing proceeds from separate thefts is characteristic of a single operator reusing laundering infrastructure, and it is the kind of evidence that strengthens attribution beyond stylistic similarity.
One caveat worth keeping. TRM Labs and Chainalysis are private blockchain analytics firms. At the time of writing, no government had confirmed the attribution. Their track record on this is strong, and the FBI confirmed their read on Bybit within a week, but a private-sector attribution is not the same as an official one.
Where the money went
Funds moved across ten blockchains, including Bitcoin and Ethereum, which Chainalysis reported monitoring. Token issuers moved quickly to lock stolen funds, which is how roughly $3 billion came to be frozen.
The freezing is only possible for certain assets. Centrally issued tokens, such as some stablecoins, can be frozen by their issuer. Bitcoin and Ether cannot. That distinction determines how much is recoverable, and it is why the frozen share is not higher.
Context on scale
Bybit, February 2025: $1.5 billion, also attributed to TraderTraitor. Previously the largest crypto theft, and reportedly the largest heist of any kind on record.
Earlier records: Ronin Network $624 million, Poly Network $611 million, BNB Bridge $586 million.
North Korea's 2025 total: around $2 billion across all crypto thefts.
This single incident is roughly three times what North Korea's operations stole in all of 2025.
On the North Korean economy comparison
The claim circulating is that $6.3 billion represents a substantial share of North Korea's annual GDP. The direction is right, and the sum is unquestionably enormous relative to the country's economy. But North Korean GDP figures are estimates produced without reliable national statistics, and they vary considerably between sources. Any precise ratio should be treated as indicative rather than factual.
What is better established is the purpose. Reporting and successive UN panel findings have documented that North Korea uses cryptocurrency theft to fund state operations and evade international sanctions, and that Kim Jong Un's government has leaned increasingly on hacking as its economy has struggled.
Why it matters
The attack surface was an employee's computer, not the blockchain. Billions in assets were protected by cryptography that was never broken. The attacker went around it, through the organisation. Every exchange, custodian and treasury operation should read this as a statement about endpoint security and privileged access, not about wallet design.
Hot wallet signing systems are the crown jewels. If an attacker can induce the signing system to produce valid signatures, key custody becomes irrelevant. The control that matters is not where the keys live, it is who or what can ask them to sign, and what approvals sit in that path.
Twenty minutes is faster than any human response process. No approval workflow, no SOC escalation and no manual intervention operates at that speed. Anything that was going to stop this had to be automatic and had to be in the signing path itself.
Freezing worked, partially, and only because of centralisation. Roughly half was frozen because token issuers could act. That is a meaningful defence, and it also illustrates that the recoverable portion depends on asset type rather than on anyone's incident response.
The scale changes the sanctions picture. A single operation yielding roughly three times the previous year's total is not an incremental increase. It is a step change in the resources available to a sanctioned state, and it will drive regulatory and law enforcement attention across the sector.
Binance covering losses protects users, not the lesson. The SAFU fund means customers are made whole. It does not make the money unstolen, and it does not reduce what the proceeds will be used for.
Who is affected
Binance customers, who the exchange says will be covered by its SAFU fund and company funds.
The wider exchange and custody sector, now facing renewed questions about endpoint security and signing architecture.
Token issuers, who were able to freeze part of the proceeds and will face pressure to act faster in future.
Regulators and law enforcement, particularly those enforcing North Korea sanctions.
Any organisation operating a signing or treasury system, in crypto or otherwise, where a compromised engineering workstation could reach a transaction authorisation path.
Employees at crypto firms, who are the demonstrated target. The attack chain began with a person, not a protocol.
What organisations should do
If you operate signing or treasury infrastructure
Map every path from an engineering workstation to a signing system. The question is not whether keys are protected, but what can instruct them to sign and who can reach that.
Require multi-party approval for value transfers above a threshold, enforced in the signing system rather than in process documentation.
Set automatic velocity and volume limits in the signing path. Twenty minutes is too fast for a human to intervene. Something non-human has to say no.
Separate the environment that can initiate withdrawals from the environment engineers work in daily. A service container reachable from a laptop is the specific failure here.
Monitor for withdrawals across multiple chains simultaneously, which is an unusual pattern and was the signature of this event.
Endpoint and identity, because that is where it began
Treat developer and DevOps workstations as privileged systems. They frequently hold credentials, tokens and access to production paths that no ordinary user account has.
Deploy phishing-resistant MFA on everything reachable from those machines.
Assume infostealer infections are identity incidents. Rotate credentials and revoke sessions rather than cleaning the machine and moving on.
Brief engineering staff specifically. North Korean operators have repeatedly targeted developers through fake recruitment approaches, trojanised coding tasks and malicious packages. The person at the keyboard is the target.
Governance
Rehearse an incident at machine speed. Ask what your organisation could actually do within twenty minutes, and build whatever that answer requires.
Know which of your assets can be frozen and by whom, and have the contacts ready before you need them.
Do not rely on a single analytics firm's attribution for decisions with legal consequences. For operational defence, act on it. For anything formal, wait for official confirmation.
Final thoughts
Six point three billion dollars moved across ten blockchains in about twenty minutes, and the path to it ran through one engineer's laptop. The cryptography held. The private keys, by Binance's account, were never leaked. None of it mattered, because the attacker did not attack the cryptography. They attacked the organisation wrapped around it.
The lesson: in any system protected by signatures, the real perimeter is whoever can cause a signature to be produced. Key custody receives enormous attention because it is tractable and measurable. The path from a developer's workstation to the system that signs receives far less, because it crosses teams and looks like ordinary infrastructure. That path is where both this heist and the Bybit heist actually happened.
The second lesson is about speed. Roughly half the money was frozen, which is a genuine success and would have been impossible a few years ago. But the theft itself was completed in twenty minutes, long before any human decision could be made. Everything that worked afterwards was recovery. Everything that could have prevented it would have had to be automatic.
Two questions worth answering this week, whatever industry you are in: what is the shortest path from an engineer's laptop to a system that can move money, and what would stop a transaction at minute three rather than hour three?
