Binance Absorbs $6.3 Billion Loss After Record North Korean Hack

Key points

• Binance confirmed a $6.3 billion theft from its hot wallets, described as the largest crypto heist in history.
• The exchange suspended withdrawals and pledged to cover all user losses using its Secure Asset Fund for Users and corporate treasury.
• TRM Labs attributed the attack to the North Korean hacking group TraderTraitor with high confidence.
• Binance initially cited a compromised laptop but later acknowledged a more complex intrusion involving multiple points of access.
• Approximately $3 billion in stolen assets were frozen on-chain with the help of industry partners like Circle.
• Binance reported covering 90% of the stolen assets by Saturday, with the remaining 10% consisting of less liquid tokens.

Background

This incident follows earlier reports from October 30, 2026, which indicated a suspected $2.5 billion breach that caused significant market volatility. Initial coverage highlighted the freeze of assets and the involvement of stablecoin issuers like Tether and Circle. The current developments confirm the scale of the theft and Binance's commitment to full user compensation, contrasting with earlier uncertainty about the exact amount and method of the attack.

How outlets are covering it

The New York Times focused on the immediate response, detailing the formation of a 100-person war room on Wea and the rapid outflow of funds. Fox Business emphasized the potential for a broader wave of AI-driven cyberattacks, citing expert Eric Schiffer, and highlighted President Trump's investigation into North Korean involvement. CNBC provided a detailed financial breakdown, noting that Binance had covered 90% of the stolen assets by Saturday and was using its insurance fund and treasury to replenish the remaining 10%. While all sources agreed on the $6.3 billion figure and the North Korean attribution, they differed in emphasis: The Times on the operational response, Fox Business on the geopolitical and future threat implications, and CNBC on the financial recovery and technical details of the breach.

Why it matters

This breach represents the largest cryptocurrency theft in history, raising significant concerns about the security of major exchanges and the potential for state-sponsored cyberattacks. The incident has led to a temporary suspension of withdrawals and a pledge by Binance to cover all user losses, which may impact investor confidence. The involvement of North Korean hackers and the use of AI in the attack suggest a growing threat to global financial infrastructure, potentially leading to increased regulatory scrutiny and security measures in the crypto industry.

What to watch

Binance plans to resume withdrawal services by Sunday, subject to security checks. The exchange will continue to purchase the remaining 10% of stolen assets through market and over-the-counter channels. A detailed technical report on the breach is expected once the investigation is complete. Law enforcement agencies, including the U.S. Secret Service, are working to identify and recover the stolen funds. The incident may lead to increased scrutiny of cybersecurity practices in the cryptocurrency industry and potential regulatory changes.