TL;DR · 30-second read
The Short Version
Hackers moved about $6.3 billion in digital currency out of Binance, the world’s largest cryptocurrency trading site, mostly within about 20 minutes. That would be the biggest crypto theft ever recorded.
Two private firms that trace crypto payments say a North Korean government hacking team was likely behind it. Binance says customers will be repaid and that about half the money has been frozen.
The surprising part: Binance says the secret codes that control its funds were never stolen. That suggests the attackers fooled the approval system around those codes. It is like tricking the bank teller instead of stealing the vault key.
Binance, the world’s largest cryptocurrency exchange, said a security incident impacted approximately $6.3 billion in assets. The Associated Press reported that blockchain intelligence firm TRM attributed the attack “with high confidence” to TraderTraitor, which TRM describes as North Korea’s elite hacking unit. TRM said an attacker moved about $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes, which would make it the largest cryptocurrency theft on record. Chainalysis CEO Jonathan Levin wrote that the attack was “likely done by DPRK group TraderTraitor.”
Binance said on Friday, October 30, 2026, that it had worked with blockchain partners to freeze roughly $3 billion of the affected assets. It said deposits were unaffected, that withdrawals were suspended and expected to resume within a day or two, and that it will cover all losses. The company said it found no evidence of any wallet private key leak.
Executive Summary
The size of the loss is the headline figure, but Binance’s own account of the breach is the more useful detail. The exchange says no private key leaked. A private key is the cryptographic secret that authorizes spending from a crypto wallet. Even so, more than $6 billion left its wallets in minutes. Binance said an early review suggested a compromised laptop, and that a later review found additional “points of breach.” Taken together, those statements put the focus on the systems, devices and permissions that decide what a wallet signs, rather than on the keys themselves.
That matters well beyond crypto. Any organization that runs automated, internet-connected signing or payment infrastructure relies on the same kind of approval chain: credentials, session tokens, device trust and policy rules. If two blockchain analytics firms are right about the attribution, a state-backed group has now twice extracted more than a billion dollars from major exchanges in under two years. Bybit’s $1.5 billion loss in February 2025 was the earlier case, and the FBI attributed it to North Korea and TraderTraitor.
How a Safe Key and a $6.36 Billion Loss Can Both Be True
A crypto wallet’s private key works like a master signature. Whoever can produce it can move the funds. A “hot wallet” keeps that capability online so an exchange can process customer withdrawals quickly. Binance says it found no evidence that any wallet private key leaked. Yet TRM says roughly $6.36 billion moved across ten blockchains, most of it in about 20 minutes. If both statements hold, the keys were never stolen. Instead, the system holding them was instructed to sign transactions through channels it treated as legitimate.
That is the approval layer: the laptops, accounts, session tokens and policy engines that sit between a person or process and the signing system. Binance’s early statements point there. It cited a compromised laptop, then additional points of breach. Kok Tin Gan, CEO of cybersecurity firm NyxLab, offered a sharper version: “This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet.” That is an outside assessment. Binance has not confirmed the mechanism and says technical details will follow when its probe is complete. Still, every published detail is consistent with an attack on authorization rather than on key storage.
The people most affected are the engineers and risk officers who run custody at exchanges, crypto custodians and fintech payment platforms. Much of this industry’s security investment has gone into protecting keys, through hardware security modules, multi-party computation and cold storage. Those defenses matter. But they do not stop a key from signing a transaction that the approval chain has already authorized. Enterprise cloud teams face the same problem with long-lived access tokens and over-broad service permissions, which is why this incident deserves attention outside crypto.
Twenty Minutes Makes This a Prevention Problem
Most of the money moved in about 20 minutes, across ten separate blockchains. That pace is too fast for a human security team to notice, escalate and respond. When an attacker can act that quickly, alerts that fire afterward can only limit the damage. The controls that could have changed the outcome are the ones that act before a transaction is signed. Common examples in the industry include spending caps per time window, mandatory delays on unusually large transfers, approval from several independent people for high-value moves, and access tokens that expire quickly and are narrowly scoped.
It is not yet public which of these controls Binance had in place, or how they were bypassed, so any verdict on its design would be premature. What the incident does establish is that even the industry’s largest operator was exposed to a single sequence of events moving several billion dollars. Freezing roughly $3 billion afterward shows that cooperation between exchanges, blockchain issuers and analytics firms can recover a meaningful share. It also shows the limits of that cooperation. Roughly $3.3 billion of the reported $6.3 billion had not been reported frozen.
Attribution: Two Firms, a Familiar Pattern, No Official Word Yet
The North Korea link currently rests on the judgment of two blockchain analytics companies. TRM stated “high confidence” and said several features of the attack match earlier North Korea-linked heists, including Bybit. Chainalysis’s CEO used the word “likely.” Both firms have long track records in tracing illicit flows, and the Bybit precedent, which the FBI attributed to the same group, gives the comparison weight. Even so, a pattern match is not a formal government attribution. Binance itself has declined to confirm and says it is working with law enforcement to identify those responsible.
If the attribution holds, the scale is striking. South Korea’s spy agency estimated in December 2022 that North Korean hackers had stolen about $1.1 billion in crypto and other virtual assets over the preceding five years. This single incident would be several times that total and about four times Bybit’s $1.5 billion loss. Experts have long described crypto theft as a source of foreign currency for North Korea’s sanctioned economy and nuclear program. That makes exchange security an issue for sanctions enforcement as well as for consumer protection.
Covering the Loss Is a Promise; the Details Are Still to Come
Binance says it will cover all losses. Founder Changpeng Zhao, who no longer runs the company, wrote that “as a shareholder, I expect all user funds will be fully covered.” Those are meaningful public commitments. However, the company has not said how the remaining shortfall will be funded or over what period, and it has not said whether recovered funds will offset it. Withdrawals remain suspended, with resumption expected within a day or two. Whether that timeline holds will be the first practical test of the commitment for customers.
For market participants, the event highlights concentration risk. When the largest exchange halts withdrawals, liquidity and pricing across the wider market depend on how quickly it reopens. Institutional clients and counterparties will likely ask for more than a promise of reimbursement. They will want evidence that the specific approval path the attackers used has been closed.
Background
Binance was founded in 2017 by Changpeng Zhao and is the world’s largest cryptocurrency exchange. In 2023, Zhao pleaded guilty to a felony related to failing to prevent money laundering on the platform and stepped down as CEO. U.S. President Donald Trump pardoned him in 2025. Exchanges like Binance hold large pools of customer assets, part of which sits in internet-connected hot wallets so that withdrawals can be processed quickly.
North Korea-linked groups have been tied to a string of major crypto thefts. In December 2022, South Korea’s spy agency estimated that North Korean hackers had stolen about 1.5 trillion won ($1.1 billion) in virtual assets over five years, and described their capability as among the best in the world. In February 2025, Bybit lost $1.5 billion in a hack the FBI attributed to North Korea and TraderTraitor. Source: Blockchain intelligence firms link North Korea to $6.3B hack on Binance (AP News), reporting on TRM’s and Chainalysis’s attribution and on Binance’s statements about the breach. See also Binance flags ‘potential security issue,’ says approximately $6.3 billion impacted (AP News).Sources