Binance absorbs $6.3 billion North Korean heist as industry scrambles to harden defenses

Key points

• Binance lost $6.3 billion in digital assets in a 20-minute breach on October 29, 2026, attributed to the North Korean hacking unit TraderTraitor.
• The exchange pledged to absorb all customer losses, reserving over $6.34 billion in company funds, including $5 billion in the same cryptocurrencies that were stolen.
• Approximately $3 billion in stolen assets have been frozen on-chain with the help of industry partners like Circle, while recovery efforts continue.
• Binance’s initial investigation identified a compromised engineer’s laptop, but later revealed additional points of intrusion, including compromised internet-connected wallets.
• Withdrawals were suspended and are expected to resume around 6 a.m. UK time on Sunday, with deposits already restored.
• Blockchain intelligence firm TRM Labs attributed the attack to TraderTraitor with high confidence, noting the group moved funds across 10 blockchains.

Background

This incident follows a series of major crypto exchange breaches, including a $1.5 billion theft from Bybit last year attributed to the same North Korean group. Previous archive coverage noted that stablecoin issuers like Tether and Circle halted transactions to prevent laundering, and that Bitcoin prices dipped modestly due to market resilience. The current breach is described as the largest in history, surpassing previous records and highlighting systemic risks in centralized custody.

How outlets are covering it

The Washington Post emphasizes the speed and scale of the theft, noting the cat-and-mouse game as hackers split funds among wallets. Fox Business highlights expert Eric Schiffer’s warning of an impending 'AI hacking bloodbath' and the potential loss of investor confidence, while also noting Trump’s involvement and the Secret Service’s response. The Financial Times focuses on the industry-wide response, with competitors like Coinbase and Kraken tightening security and calling for real-time incident notifications. CNBC highlights the personal spat between Binance co-founder Changpeng Zhao and Elon Musk, with Zhao urging Musk to stop trolling and show support, citing Binance’s equity stake in SpaceX. All sources agree on the attribution to North Korean hackers and the scale of the theft, but differ in emphasis: Post on the mechanics, Fox on future risks, FT on industry response, and CNBC on the Musk-Zhao dynamic.

Why it matters

The $6.3 billion breach is the largest cryptocurrency theft in history, exposing vulnerabilities in centralized exchanges and prompting a wave of security upgrades across the industry. It raises concerns about AI-driven cyberattacks and the need for proactive cybersecurity measures. The incident also tests Binance’s financial resilience and investor confidence, with the exchange pledging to cover all losses from its own reserves. The involvement of North Korean hackers and U.S. law enforcement underscores the geopolitical dimensions of crypto security.

What to watch

Binance expects to restore withdrawals around 6 a.m. UK time on Sunday, pending security checks. The exchange will release a detailed technical report once the investigation is complete. Industry competitors are likely to continue tightening security measures, including cold storage systems and phone protections. The U.S. Secret Service and other law enforcement partners will continue to trace and recover stolen funds. Experts predict a potential wave of AI-powered cyberattacks, urging businesses to treat cybersecurity as a proactive measure. The incident may also lead to increased scrutiny of centralized custody and calls for industry-wide security mechanisms.