Binance hack: $6.3 billion theft attributed to North Korea

Binance says it has covered 90% of the $6.3 billion stolen in what is described as the largest crypto theft on record. The FBI attributes the attack to North Korea, and withdrawals have resumed on several networks.

What happened

Binance, described as the world's largest cryptocurrency exchange, suffered a cyberattack that led to estimated losses of $6.3 billion in user assets [1][2]. One report dates the attack to October 29, 2026, and BBC News calls it Thursday's hack [1][3]. Another report dates the theft to 31 October 2026, so the exact timing is reported inconsistently [4]. It is widely described as the largest cryptocurrency theft in history [5][6][2].

Binance first assured users on October 30 that funds were safe while investigations continued [1]. It later said it had covered 90% of the $6.3 billion and pledged full user reimbursement from more than $6.34 billion in company funds [3]. A separate report says the coverage would come from its SAFU fund, futures insurance and corporate treasury [7]. Withdrawals, which had been suspended, resumed on several networks on Sunday [3][7].

BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are described as fully backed [7]. The remaining 10%, in less-liquid tokens, is pending sourcing [7].

On the technical side, the attackers reached Binance's hot wallet signing system, which let funds move automatically to them [2]. An earlier report instead describes a compromised engineer laptop used to reach withdrawal systems, with a theft lasting about 20 minutes and covering 30–40 token types [8].

On attribution, the FBI blamed North Korea and named the Lazarus Group, also called TraderTraitor [3]. Two major blockchain analytics firms identified the same group with high confidence [2].

Figures on recovery differ between reports. Binance reported about $3 billion in stolen assets frozen with law enforcement [4][3]. One account says Binance has recovered 80% of the stolen assets, with $1.26 billion unaccounted for [2]. An early report put the theft at roughly $9 billion, with $4.2 billion frozen and about $3.4 billion untraced [8]. That is well above the $6.3 billion in the other reports [5][1][8].

FinUties' news monitor logged 28 reports on this story from 9 outlets in the last days, and 107 earlier related reports going back to 2025-11-12.

How we got here

The theft follows a series of attacks on crypto platforms tied to North Korea. The previous record was Bybit's $1.5 billion hack in February 2025 [5]. Another report puts the Bybit loss at $1.4 billion [9]. TraderTraitor-linked thefts have totalled at least $13.5 billion since 2025, according to experts [4].

A September 8, 2026 analysis found that crypto platforms lost over $3.63 billion to cyberattacks and stolen passkeys between January 2025 and July 2026 [9]. It also found that 88% of stolen funds came from platforms that had completed independent security audits [9]. It concluded that auditing standards do not cover the attack routes threat actors actually use [9]. It named the Bybit heist, a $292 million KelpDao loss and a $285 million Drift Protocol loss [9].

On September 25, 2026, Bitget reported a contained breach of about $351.6 million [10]. CEO Gracy Chen cited preliminary evidence pointing to North Korean hackers, including VPN-linked IP addresses and attack patterns resembling earlier attributed operations [10]. A backend wallet compromise was used to spoof transfers and trigger authorization signing [10]. Bitget said cold wallets were not affected and ruled out private key compromise [10]. It said losses would be covered by a User Protection Fund exceeding $464 million, and withdrawals stayed suspended pending repairs [10].

The Binance case is far larger than those earlier incidents. As with Bitget, the reported entry point was an operational wallet-signing system rather than offline storage [2][10]. Experts say TraderTraitor targets developers and IT staff using malware and fake job interviews [4]. They also say it moves proceeds through Chinese money-laundering networks to fund North Korea's nuclear, ballistic missile and drone programmes [4]. What changed is the scale, and the framing of the theft as a national security incident [4].

Why it matters for markets

The theft could weigh on confidence in exchange custody. Reports describe immediate market turmoil and custody concerns across the sector, and warn of risks to user confidence, platform solvency and broader crypto market stability [5][1]. How far these concerns spread would depend on whether Binance's pledged coverage holds. It is not yet known whether the remaining 10% in less-liquid tokens can be sourced quickly [7].

The resumption of withdrawals on several networks could ease pressure on the platform [3]. Whether it does would depend on user behaviour in the coming days, which is not yet known.

The Bybit and Bitget cases, alongside the audit findings, could add weight to arguments that standard security checks fall short [9][10]. Al Jazeera reports calls for stricter regulatory frameworks, and experts disagree on whether crypto platforms can prevent such breaches [6]. No new rules are described as decided.

No clear channel from the theft to interest rates or currencies is apparent in the reporting.

What to watch

• Reimbursement progress. Binance has pledged full user reimbursement, with 90% reported as covered [3][7]. The remaining 10% in less-liquid tokens still needs to be sourced [7].
• Recovery numbers. Reported figures differ widely, from $3 billion frozen to $4.2 billion frozen, and from $1.26 billion unaccounted for to about $3.4 billion untraced [4][2][8]. A confirmed accounting has not yet been published.
• Withdrawals. Resumption has so far covered several networks [3]. It is not yet known whether service will extend to all of them.
• Investigation findings. Reports differ on how the attackers got in, citing either the hot wallet signing system or a compromised engineer laptop [2][8].
• Regulatory response. Calls for stricter frameworks are already circulating [6]. It is not yet known whether authorities will act.
• Laundering of proceeds. Experts say proceeds typically flow through Chinese money-laundering networks [4]. Binance has said about $3 billion is frozen with law enforcement [3].

Sources

1. World News: Latest International News & Updates | The Hindu: What we know about Binance’s multi-billion-dollar crypto hack | Explained, 31 Oct 2026
2. BBC News: Why North Korea's 'elite' hackers are the prime suspect in major Binance hack, 31 Oct 2026
3. BBC News: Crypto firm Binance covers 90% of losses after $6.3bn hack, 31 Oct 2026
4. World News: Latest International News & Updates | The Hindu: North Korean hackers linked to crypto thefts among world's best, experts say, 31 Oct 2026
5. France 24: Binance hit by 6.3 billion dollar crypto theft, 31 Oct 2026
6. Al Jazeera: How vulnerable are cryptocurrency platforms?, 31 Oct 2026
7. US Top News and Analysis: Binance resumes withdrawals following $6.3 billion hack, says 90% of stolen user assets are covered, 31 Oct 2026
8. Top Stories: Who was behind the largest crypto heist in history?, 30 Oct 2026
9. US Top News and Analysis: Crypto platforms have lost over $3.63 billion to cyberattacks — even though most of them did security checks, 08 Sep 2026
10. US Top News and Analysis: Crypto platform Bitget suspects North Korea is responsible for $352 million hack, 25 Sep 2026

---

FinUties generates this briefing for transparency. Published after editorial review. It may summarize source data and does not provide investment recommendations. Data availability at one timestamp does not guarantee future continuity.

Provenance

• Study: event-desk-20261101-binance-hack-6-3-billion-theft-attributed-to-north-korea (60270c7d-7da3-44ed-b8a9-f45624a21a48)
• Author: FinUties Research
• Approved by: FinUties Research at 2026-11-01T22:34:24.910189Z
• Kind: event brief (news sources, not a FinUties dataset study)
• Cited sources: 10 from 6 outlets, all licensed for public use

• Earlier related events cited from 2026-09-08

• Manifest: /api/v1/research/studies/event-desk-20261101-binance-hack-6-3-billion-theft-attributed-to-north-korea/manifest

• Replay tolerance: append_only_sources