Binance Suffers Record $6.3 Billion Breach in 20-Minute North Korean Attack

Key points

• The breach occurred on October 29, 2026, lasting approximately 20 minutes and draining $6.3 billion from Binance hot wallets across at least ten blockchains, including Ethereum, Bitcoin, Tron, and Sol.
• Crypto tracing firms TRM Labs and Chainalysis attribute the attack to the North Korean hacking group TraderTraitor, citing similarities with the 2025 Bybit hack and the use of a compromised engineer’s laptop as an entry point.
• Binance suspended all deposits and withdrawals immediately after the breach, stating that initial investigations pointed to a compromised laptop but subsequent findings revealed additional points of breach.
• Approximately $2.8 billion, or 44% of the stolen funds, has been frozen, primarily consisting of stablecoins; the remaining $3.3 billion in Bitcoin, Ether, and XRP cannot be frozen and may be lost.
• Binance pledged to cover all customer losses using its Secure Asset Fund for Users, while stablecoin issuers Tether and Circle halted transactions linked to the event to prevent further movement of stolen assets.
• The attack triggered a broader market panic, causing significant volatility in cryptocurrency markets and contributing to a global tech stock sell-off alongside disappointing AI earnings from Amazon and Intel.

Background

This incident follows the February 2025 Bybit hack, where North Korean hackers stole $1.5 billion, previously the largest crypto heist. Recent archive coverage indicates that Binance had already faced market volatility and asset freezes in the days leading up to the confirmed breach, with founder Changpeng Zhao assuring users of fund security before the full extent of the $6.3 billion loss was confirmed. The current attack highlights ongoing vulnerabilities in crypto infrastructure, particularly regarding hot wallets and third-party access, as highlighted by a concurrent $2.6 million breach at Polymarket.

How outlets are covering it

The New York Times emphasizes the broader implications of the hack for crypto’s financial infrastructure and the use of AI in laundering funds, framing it as the start of a risky new era. WIRED focuses on the technical specifics, detailing the 20-minute execution, the 36-hour preparation period, and the specific attribution to TraderTraitor by tracing firms. The Atlantic highlights the immediate market aftershocks and compares the scale to historical heists, noting the simultaneous but unrelated breach at Polymarket. While all sources agree on the $6.3 billion figure and North Korean involvement, WIRED and The Atlantic provide more detail on the technical mechanics and market reactions, whereas The New York Times focuses on the systemic risks and customer protections.

Why it matters

The breach exposes critical vulnerabilities in cryptocurrency exchanges, particularly regarding hot wallets and employee access, and demonstrates the sophistication of state-sponsored cybercrime. The inability to freeze a significant portion of the stolen funds, particularly Bitcoin and Ether, raises concerns about the finality and security of digital assets. The event has triggered a market-wide panic, affecting not only crypto but also global tech stocks, and underscores the need for enhanced security measures and regulatory oversight in the digital finance sector.

What to watch

Binance is working with law enforcement to identify the attackers and recover the remaining unfrozen funds. Crypto tracing firms are monitoring for new laundering patterns, while stablecoin issuers continue to halt transactions linked to the breach. The market is expected to remain volatile as investors assess the impact on crypto infrastructure and the potential for further attacks. Regulators may increase scrutiny on exchange security practices and third-party provider vulnerabilities in the coming weeks.