Binance Loses $6.3 Billion in Record Hack, Likely by North Korean Group

Key points

• Binance suspended all deposits and withdrawals after hackers drained $6.3 billion from its hot wallets across ten blockchains, including Bitcoin and Ethereum, in a 20-minute window on October 29.
• Crypto tracing firms TRM Labs and Chainalysis attribute the attack to the North Korean hacking group TraderTraitor, citing on-chain evidence and similarities to the 2025 Bybit hack.
• Binance and other firms have frozen approximately $3 billion of the stolen assets, mostly stablecoins, but analysts estimate the remaining $3.3 billion in Bitcoin, Ether, and XRP cannot be frozen and may be lost.
• Binance founder Changpeng Zhao confirmed the incident appears to be a hack, while co-CEO Richard Teng indicated a compromised DevOps engineer's laptop was the initial entry point.
• The FBI and US Secret Service are assisting Binance in the investigation, and the exchange has pledged to cover all customer losses despite the unprecedented scale of the theft.

Background

This incident follows a series of major crypto heists, including the $1.5 billion Bybit hack attributed to North Korea in 2025. Earlier reports on October 29 indicated a suspected $2.5 billion breach, which escalated to the confirmed $6.3 billion figure as the full scope of the attack became clear. The event triggered significant volatility in crypto markets, with Bitcoin falling below $78,000, and contributed to broader tech market sell-offs on October 30.

How outlets are covering it

WIRED and The New York Times emphasize the scale of the theft and the likelihood of North Korean involvement, with WIRED highlighting the 20-minute execution time and TRM Labs' analysis of the attacker's rehearsal. CNBC focuses on the market impact, noting the freeze of $3 billion by Binance, $800 million by Circle, and $1.56 billion by Tether, while also covering the broader tech sell-off. The Miami Herald, citing Reuters, confirms that the FBI and US Secret Service are actively working with Binance, a detail not explicitly detailed in the other sources. While all outlets agree on the $6.3 billion figure and the freeze of assets, they differ in emphasis: WIRED and NYT focus on the attribution to North Korea, while CNBC highlights the financial market reactions and the specific breakdown of frozen assets by stablecoin issuers.

Why it matters

The $6.3 billion theft is the largest crypto heist in history, nearly doubling the total amount stolen by North Korea in previous incidents. It highlights the vulnerability of major exchanges to sophisticated state-backed actors and raises concerns about the security of hot wallets. The inability to freeze a significant portion of the stolen funds, particularly Bitcoin and Ether, suggests that a substantial amount of the money may be permanently lost or laundered, potentially impacting the stability and trust in the cryptocurrency ecosystem.

What to watch

Binance is continuing its investigation in coordination with law enforcement, including the FBI and US Secret Service. Crypto firms are attempting to track and freeze the remaining unfrozen assets, but analysts expect the frozen share to rise only marginally as the untraceable portions of the theft are moved. The investigation will likely focus on identifying the specific entry point, such as the compromised laptop, and determining the full extent of the attacker's access. Market volatility may persist as investors assess the security risks of major crypto platforms.