Home » Security » Binance Hack: $6.3 Billion Stolen, FBI Blames North Korea
Binance Hack: $6.3 Billion Stolen, FBI Blames North Korea
- The key facts
- How the theft unfolded
- How the attackers got in
- Who is behind it
- What Binance says it is doing
- Step 1: if you hold funds on Binance, check the official status
- Step 2: ignore "recovery" and "compensation" offers
- Step 3: check the proof of reserves when it is published
- Step 4: think about where you keep long-term holdings
- Common mistakes
Short answer: On October 29, 2026, attackers moved about $6.3 billion in crypto out of Binance wallets in roughly 20 minutes. It is the largest crypto theft on record, about four times the 2025 Bybit hack. The FBI says North Korea's TraderTraitor unit did it. Binance says users will not lose money and it has covered the losses from company funds.
The key facts
- When: October 29, 2026, starting around 20:05 UTC
- How much: about $6.36 billion at the time of transfer, per TRM Labs
- Where: hot wallets on ten blockchains
- Who: TraderTraitor, a North Korean state-backed group, per the FBI
- Frozen so far: about $3 billion, per Binance
- Customer losses: none, Binance says
A hot wallet is one kept online so an exchange can process withdrawals quickly. That convenience is also what makes it a target.
How the theft unfolded
TRM Labs, a blockchain analysis firm, traced the transfers minute by minute. The first funds left on the XRP Ledger at 20:05 UTC. Solana and Optimism followed minutes later, and by 20:20 UTC the attacker had swept Bitcoin, Tron and the main Ethereum wallet. A second wave hit Avalanche and Polygon around 23:05 UTC.
| Chain | Approximate value taken |
|---|---|
| Ethereum (ETH and stablecoins) | $3.79 billion |
| Bitcoin (18,270 BTC) | $1.47 billion |
| Tron | $628 million |
| XRP Ledger | $296 million |
| Solana | $96 million |
| Other chains combined | under $80 million |
Stablecoin issuers moved fast. Tether froze about 971 million USDT within an hour, and Circle froze 823 million USDC. TRM estimated about $2.4 billion was still out of reach of any freeze by early October 30.
How the attackers got in
Binance says the attack started with an engineer's laptop. In its words, reported by TechCrunch, the compromised laptop "allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." It says it found no sign its private keys leaked.
TRM's read is that the attacker gained control of the system that signs Binance's hot wallet transactions, which explains how ten chains were drained at once. TRM also found the attacker began preparing at least 36 hours earlier. Binance has not published a full root cause.
Who is behind it
TRM attributed the theft to TraderTraitor "with high confidence," and Elliptic linked the funds to wallets from an earlier hack on the Bitget exchange. On October 31 the FBI said the same unit was responsible, Reuters reported via NBC News. The FBI also named TraderTraitor for the $1.5 billion Bybit theft in 2025.
What Binance says it is doing
Co-CEO Richard Teng said on X: "We've now replenished 90% of the stolen assets, and we're committed to covering the remaining 10%. Our users will not bear the financial impact of this incident."
Binance says the $6.34 billion came from its SAFU emergency fund, part of its futures insurance fund and its own treasury. It paused withdrawals after the attack and said on October 31 it expected to reopen them on November 1. It has promised a new proof of reserves, a public check that customer balances are fully backed.
Step 1: if you hold funds on Binance, check the official status
Use the Binance app or its verified X account for withdrawal status. Don't rely on screenshots or posts from accounts you don't know.
Step 2: ignore "recovery" and "compensation" offers
Big hacks bring a wave of scams: fake refund forms, fake support agents and links asking you to connect your wallet. Binance says users don't need to do anything to be covered, so any message asking for your login, seed phrase or a payment is a scam.
Step 3: check the proof of reserves when it is published
Binance says it will publish updated reserves after remediation. That is the evidence behind the "user funds are safe" claim. Until then, it is Binance's word.
Step 4: think about where you keep long-term holdings
Funds on any exchange depend on that exchange's security. Money you don't plan to trade can sit in a wallet you control. Keep the seed phrase offline and never type it into a website.
Common mistakes
- Saying customers lost $6.3 billion. Binance lost it and says it has covered users.
- Treating $6.3 billion, $6.36 billion and $6.34 billion as conflicting. They measure theft, value at transfer time and Binance's coverage fund.
- Stating the root cause as fact. Binance has described a compromised laptop, but no full report exists yet.
- Clicking "Binance refund" links. Legitimate compensation does not need your seed phrase.
Sources
Frequently Asked Questions
Did Binance customers lose money in the hack?
Binance says no. It says it set aside about $6.34 billion of company funds to cover the losses and that users will not bear the financial impact. It has promised an updated proof of reserves to back that up.
Who hacked Binance?
The FBI says it was TraderTraitor, a North Korean state-sponsored hacking unit. Blockchain analysis firms TRM Labs and Elliptic reached the same conclusion independently.
How did the hackers get into Binance?
Binance says an engineer's laptop was compromised, which gave the attacker access to a system that could submit withdrawals. It has not published a full root cause yet.
Found a mistake or still stuck? Contact us. See how we write and check these guides in our editorial policy, or read about DocumentGuy.