North Korean hackers reportedly stole $6.3 billion in crypto from Binance

On October 29, at 9:05 p.m. (Paris time), five Binance wallets on the XRP ledger were emptied in four minutes. A quarter of an hour later, 18,270 bitcoins left another wallet on the platform. Then an Ethereum wallet was drained entirely. According to analytics firm TRM Labs, which reconstructed the timeline, the operation hit ten cryptocurrency networks and lasted nearly four hours.

The amount is staggering: about $6.36 billion according to TRM Labs, $6.4 billion according to Chainalysis. It would be the largest cryptocurrency theft ever recorded, far ahead of the Bybit heist in February 2025 (about $1.5 billion). Binance, the world's largest exchange, confirmed the attack overnight, then suspended deposits and withdrawals.

A laptop, then other breaches

On October 30, Binance offered a first lead: its initial investigation suggests the incident could involve the compromised laptop of a DevOps engineer in charge of infrastructure. From that device, the attacker allegedly reached a service container and submitted unauthorized withdrawals. The platform says it found no sign that its wallets' private keys had leaked.

A few hours later, the story got more complicated. Binance said it had found other intrusion points beyond that laptop. Its co-CEO Richard Teng said, according to Help Net Security, that the attacker had not simply used the privileges of a single engineer. How the laptop was hacked, and which controls failed, remains unknown. Binance promises a detailed analysis once the investigation is complete and every fact has been verified.

TRM Labs, for its part, puts forward a hypothesis: the compromise of the signing infrastructure for "hot" wallets, meaning wallets that are permanently connected. Wallets on different networks did sign valid transfers within about thirty minutes.

The North Korean lead, put forward by two private firms

Who is behind it? TRM Labs attributes the attack "with a high degree of confidence" to TraderTraitor, the North Korean group the FBI had named for the Bybit theft. Chainalysis also considers the TraderTraitor lead likely. Clues cited by TRM: an attacker wallet funded through the Tornado Cash anonymization service, preparation begun at least 36 hours before the theft, and signatures obtained in advance, then executed in a burst. Binance has not named any group. Neither the FBI nor the U.S. Department of Justice immediately responded to requests from AFP. North Korea is no newcomer: its hackers also polish their tools.

The response was organized quickly. Tether froze about $1.77 billion in USDT and Circle about $825 million in USDC. Ripple, World Liberty Financial and the Arbitrum security council followed. Binance says close to $3 billion has been frozen. According to TRM, as of 12:30 a.m. UTC on October 30, the attacker still held more than 420,000 ether and 18,270 bitcoins, worth about $2.4 billion, which it has begun to launder.

Customers and companies: what to take away

Binance says user funds are safe and that it will cover all losses with its guarantee fund (SAFU) and its own funds. Deposits are working, but withdrawals remain suspended: the platform hopes to restore them within 48 hours.

• Binance customers: beware of messages that exploit the affair. Binance urges users to ignore links and requests for information that do not come from its official channels.
• Companies: an administrator's workstation remains a prime entry point. Separate administration machines from office computers, and limit what a single account can trigger.

It remains to be seen what the analysis promised by Binance will say. For now, one question dominates: how did the attacker manage to go so far?

Update of November 13, 2026

Several answers have arrived since the record $6.3 billion theft suffered by Binance on October 29. On October 31, the FBI officially attributed the attack to North Korea, and more precisely to the group it calls TraderTraitor, according to Decrypt. The U.S. federal police describe a theft of "more than $6 billion" and ask cryptocurrency players to block hundreds of addresses linked to the hackers. North Korea denied any involvement through Kim Yo Jong, Cointelegraph reports. Binance reopened withdrawals in stages starting November 1. In nine and a half hours, $4.65 billion left the platform, against $1.01 billion in deposits, according to its figures cited by Decrypt.

On November 3, Binance published its incident report. According to Cointelegraph, it describes a campaign lasting several months. In June, an engineer downloads booby-trapped software while installing an AI coding tool. Binance detects the malware and replaces the device, but the hackers have already gathered information about the team in charge of the wallets. In September, fake recruiters send another engineer a booby-trapped file disguised as a programming exercise, which compromises their work computer. On October 20, from that machine and using an internal AI tool, the hackers reach the workstations of two other engineers and retrieve deployment credentials. On October 29, they install malware in the wallet infrastructure and reach the internal service that signs transactions. "This was not a single mistake or breach, but a campaign lasting several months," sums up co-CEO Richard Teng.

The report also explains why transfers continued after withdrawals were suspended. The hackers exploited EIP-7702, an Ethereum feature that lets a wallet delegate its transaction rights to an automated contract (smart contract). According to Binance's latest figures cited by Cointelegraph, $2.85 billion has been frozen or intercepted. The platform maintains that it will absorb the losses on its own.