FBI Confirms North Korea Behind Record $6.4B Binance Heist

Key points

• The theft occurred on October 29, 2026, at approximately 4:05 p.m. ET, draining funds from Binance hot wallets across 10 blockchains within 20 minutes.
• The total loss is estimated at $6.4 billion, more than four times the previous record of $1.5 billion from the 2025 Bybit heist.
• The FBI confirmed on October 30 that the attack was carried out by North Korean hackers known as TraderTraitor, marking the first public confirmation by U.S. federal investigators.
• Binance CEO Richard Teng stated that the exchange will cover all losses using company funds and its Secure Asset Fund for Users, with over $6.34 billion already set aside.
• Stablecoin issuers Tether and Circle froze approximately $2.3 billion in assets, but more than $3 billion in non-stablecoin assets remains unaccounted for.
• The breach exploited EIP-7702, a 2025 Ethereum feature, to turn a hot wallet into a smart contract and drain assets, according to TRM Labs.

Background

This incident follows the February 2025 Bybit heist, which was the previous largest crypto theft at $1.5 billion. The 2026 Binance breach is the first major attack attributed to North Korea's TraderTraitor group since the Bybit incident. The breach also follows a series of smaller crypto hacks in 2025, including the $1.5 billion Bybit heist and the $2.3 billion stablecoin freeze in 2026. The incident has prompted calls for stricter U.S. oversight of offshore exchanges, as argued by CFTC Chairman Michael Selig.

How outlets are covering it

Decrypt and Fox Business agree on the core facts of the breach, including the $6.4 billion loss, the attribution to North Korea's TraderTraitor group, and Binance's pledge to cover the losses. However, Decrypt emphasizes the technical details of the breach, such as the use of EIP-7702 and the compromised DevOps engineer's laptop, while Fox Business focuses on the FBI's official confirmation and the potential for a broader wave of AI-driven cyberattacks. Decrypt also highlights the market reaction, noting that Bitcoin fell 4% but remained relatively stable, while Fox Business does not mention the market reaction. Both sources agree that stablecoin issuers froze over $2.3 billion in assets, but Decrypt notes that more than $3 billion in non-stablecoin assets remains unaccounted for, a detail not mentioned in Fox Business.

Why it matters

The breach is the largest crypto theft in history, highlighting the vulnerabilities of major cryptocurrency exchanges and the potential for state-sponsored cyberattacks. The FBI's confirmation of North Korea's involvement raises concerns about the geopolitical implications of crypto theft and the need for stronger international cooperation in combating cybercrime. The incident has also prompted calls for stricter U.S. oversight of offshore exchanges, as argued by CFTC Chairman Michael Selig. The breach has also raised concerns about the potential for a broader wave of AI-driven cyberattacks, as warned by Eric Schiffer, chairman of Patriarch and Reputation Management Consultants.

What to watch

Binance aims to restore withdrawals by Sunday and publish a complete proof of reserves by Monday. The FBI and U.S. Secret Service are expected to continue their investigation into the breach, with a focus on tracing the stolen funds and identifying the hackers. Stablecoin issuers are expected to continue freezing assets linked to the breach, while blockchain analytics firms are expected to continue tracking the movement of stolen funds. The incident is likely to prompt further calls for stricter U.S. oversight of offshore exchanges, as argued by CFTC Chairman Michael Selig.