North Korea blamed for Binance's ~$6.3B hack, the largest crypto theft on record; US moves to seize $1.2B of the stolen funds

What happened? On 29 October 2026, Binance, the world's largest crypto exchange, suffered a security incident with an estimated total impact of about $6.3 billion. That makes it the largest crypto theft on record, far above the roughly $1.5 billion Bybit hack of February 2025. Onchain data showed billions in BTC, ETH, stablecoins and other assets leaving Binance hot wallets across multiple blockchains, most of it within about 20 minutes.

Latest: On 12 November the US Justice Department said joint government and private-sector efforts have frozen more than $2.7 billion of the stolen assets, and that it has court authorization to seize or restrain more than $1.2 billion of that amount, the legal step towards forfeiture. Assistant Attorney General A. Tysen Duva said the freezes halted "about half of this historic breach". The hackers are still laundering the rest through bridges, mixers and exchanges. In a separate action, the FBI seized cloud infrastructure behind "FaceStealer", a North Korean scheme that plays secretly recorded webcam videos of earlier victims in fake Zoom and Teams meetings, which has stolen more than $400 million over 18 months (CyberScoop). Binance has already replaced the stolen assets from its own funds, so recovering the coins is a separate track (Bitcoin Magazine).

Who did it? Blockchain analytics firm TRM Labs attributes the attack to TraderTraitor, North Korea's top hacking unit, which the FBI blamed for the Bybit hack. TRM traced about $6.36 billion in transfers across ten blockchains, valued at the time each was taken. That includes about $3.79 billion on Ethereum (200,630 ETH, 1.875 billion USDT and 823 million USDC) and 18,270 BTC (about $1.47 billion). TRM says the operation was staged well before the theft, with signatures obtained in advance and executed in one burst.

How did it happen? In its initial findings published on 3 November, Binance describes a months-long, multi-stage campaign rather than a single breach. In June, a Wallet DevOps engineer searched for a popular AI coding tool and installed a tampered Homebrew package. Binance caught it, replaced the laptop and rotated credentials, but the attackers had learned who worked on the wallet team. In September, another engineer was approached on a legitimate job site by a fake "Project Director". After a live video interview with a supposed HR representative, who shared personal photos and videos to build trust, and a second round with the "CEO" of a company that does not exist, he was asked to download a take-home "assignment" onto his work laptop. The repository quietly swapped the developer tool pyenv for a malicious copy, a zero-day that endpoint security did not flag.

From laptop to hot wallet: On 20 October the attacker used Binance's own internal AI tool to get into the machines of the first engineer and a third engineer, and found a container deployment token on one of them. On 29 October they deployed a container, reached the internal wallet signing service and started sending funds outside the normal withdrawal process, beginning with 233.46 million XRP at 20:05 UTC. They also abused Ethereum's EIP-7702 mechanism to give their own smart contract execution rights over a hot wallet, so suspending withdrawals did not stop the outflows. Because the wallet used multi-party computation (MPC), there was no single private key to sign a revoke, and Binance had to build a revocation procedure on the spot. The last stolen ETH (2,961.9 ETH) settled at 23:56 UTC, almost four hours after the first transfer, and the delegation was cleared at 00:10 UTC on 30 October. Binance says it detected and blocked 57 suspected North Korea-linked attacks earlier in 2026, using fake interviews, poisoned developer tools and fake video-call apps.

Response: Binance now puts the impact at about $6.34 billion, of which about $2.85 billion has been frozen or intercepted. It says it will absorb the loss itself, and that 98% of the affected token assets had been replenished by 31 October, verifiable on its Proof of Reserves page. It cites the FBI's attribution to North Korea, has rebuilt the affected wallet system and internal AI tool, and plans an independent security review and a security research fund focused on AI security. Tether froze more than $1.5 billion in USDT, Circle more than $800 million in USDC, and Ripple helped halt about $200 million. Co-founder Yi HeDealroom has a profile for this one. Try Dealroom → said user funds are safe and that Binance will cover all losses from its SAFU fund and company funds. Withdrawals remain paused while Binance rebuilds its withdrawal systems and address controls. On 30 October it said it expected them back within about two days, and deposits are still working (crypto.news). Binance.US says it was not affected.

Fallout: Bitcoin fell more than 4% to below $78,000, BNB dropped more than 5% and Circle shares slid about 5% after hours. CoinDesk reports that institutional investors are rushing to pull assets from centralized exchanges generally, which puts custody risk across the whole sector back in focus.

Why it matters for Pyongyang: A Bloomberg Economics chart shared by Bloomberg's Joe Weisenthal puts the haul at roughly three-quarters of North Korea's estimated total revenue for 2025, from every source combined: exports, labour abroad, IT workers, illicit coal, digital-asset theft, arms sales to Russia and deployed soldiers. Taken in about 20 minutes, the Binance theft on its own outweighs every other income line in the chart. The 2022-2025 figures use high-end estimates for arms sales and troop deployments, based on Bloomberg Economics and CSIS data. Chainalysis separately reached the same attribution, putting the loss at about $6.4 billion, after seeing stolen Binance funds commingle with funds from last month's Bitget exploit, which had already been linked to North Korea.

Who are the hackers? The Financial Times looked at how Pyongyang builds the teams behind attacks like this one. "North Korean students who excel in mathematics and science are selected and trained in hacking from their teenage years," Simon Choi, chief technology officer at cyber security start-up StealthMole, told the paper. The investigation is widening: Binance first pointed to a single engineer's compromised laptop but later said the breach went further, and the US Secret Service says it is "working around the clock" to identify, freeze, trace and recover the stolen funds, the BBC reports.

Sources: US Justice Department, AP: FBI seizes $1.2B, CoinDesk: DOJ targets $1.2B, CyberScoop, Bitcoin Magazine, Binance: Initial Findings and Response Update (X), T3chFalcon summary (X), Binance: Security Incident Update, TRM Labs, CNBC, CoinDesk, TechCrunch, AP, Chainalysis, Bloomberg Economics chart via Joe Weisenthal (X), Financial Times, BBC