In what could go down as the biggest cryptocurrency heist in history, hackers have siphoned off approximately $6.3 billion from Binance, the world’s largest cryptocurrency exchange, in an extraordinarily coordinated cyberattack that has sent shockwaves through the global financial technology industry.
The scale of the theft is staggering. Billions of dollars worth of digital assets were moved out of Binance-controlled wallets spread across ten different blockchain networks, with most of the transactions executed within just 20 minutes.
But what makes the incident even more alarming is the suspected involvement of North Korea. Two leading blockchain intelligence companies have independently pointed towards TraderTraitor, an elite hacking unit linked to Pyongyang’s cyber operations and associated with the notorious Lazarus Group.
If the allegations are confirmed, the attack would add another massive cryptocurrency theft to North Korea’s growing list of cyber operations targeting financial institutions and digital asset platforms.
The United States has repeatedly accused North Korean hackers of stealing cryptocurrency to generate funds for the sanctioned regime. The Binance incident could represent the most audacious operation yet attributed to these hackers.
How hackers pulled off the $6.3 billion Binance heist
According to blockchain investigation firm TRM Labs, the attacker moved approximately $6.36 billion worth of cryptocurrency from Binance wallets across ten blockchain networks on October 29, 2026.
The transactions involved Bitcoin, Ethereum, XRP, Tron, Solana and several other digital assets.
What stands out is the speed at which the operation was executed. Rather than gradually siphoning off funds over several days, the attackers moved the bulk of the cryptocurrency within approximately 20 minutes.
TRM Labs described the incident as the largest cryptocurrency theft on record, approximately four times the size of the $1.5 billion Bybit hack in February 2025.
Binance subsequently acknowledged the security incident, describing it as a complex attack. The exchange began coordinating with blockchain intelligence companies, law enforcement agencies and cryptocurrency issuers to trace the stolen assets and prevent further movement.
The incident has also raised questions about how attackers managed to gain access to the exchange’s wallet infrastructure and execute transactions on such a massive scale.
Cryptocurrency exchanges maintain digital wallets to facilitate customer deposits, withdrawals and other transactions. Some wallets remain connected to the internet, allowing exchanges to process transactions quickly. However, these systems also present potential security vulnerabilities if access controls or transaction-authorisation mechanisms are compromised.
The exact method through which the attackers gained access remains subject to investigation.
North Korea’s TraderTraitor suspected of orchestrating the attack
The biggest development in the investigation is the suspected involvement of TraderTraitor, a North Korean hacking group associated with the Lazarus Group.
US-based blockchain investigation company TRM Labs has expressed “high confidence” that TraderTraitor was responsible for the attack.
“TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on- and off-chain intelligence. We make this judgment with high confidence,” the company said.
TRM added that several characteristics of the Binance incident resembled earlier cryptocurrency thefts attributed to North Korean hackers, particularly the February 2025 Bybit attack.
Chainalysis, another prominent blockchain intelligence company, has also pointed towards the same group.
Jonathan Levin, co-founder of Chainalysis, wrote on X that the $6.4 billion Binance attack was likely carried out by a North Korean group identified as TraderTraitor because of its links to previous hacking operations.
DPRK, or the Democratic People’s Republic of Korea, is the official name of North Korea.
The suspected involvement of the group is significant because North Korea has developed a notorious reputation for using cyber operations to target cryptocurrency exchanges, financial institutions and technology companies.
From the Sony Pictures hack to billion-dollar cryptocurrency thefts
TraderTraitor is associated with the wider Lazarus Group, one of the most notorious cyber-espionage and hacking organisations linked to North Korea.
The group came into international focus following the 2014 cyberattack on Sony Pictures Entertainment. North Korean hackers were accused of infiltrating the company’s systems, stealing confidential information and disrupting its operations after Sony produced The Interview, a comedy film depicting a fictional assassination plot against North Korean leader Kim Jong Un.
Over the years, North Korean-linked hackers have increasingly turned their attention towards cryptocurrency platforms, where successful attacks can yield enormous financial returns.
The February 2025 Bybit hack was one of the most prominent examples. The FBI attributed the theft of approximately $1.5 billion in cryptocurrency from the Dubai-based exchange to North Korean hackers associated with TraderTraitor.
That attack had been considered the biggest cryptocurrency heist in history until the latest Binance incident.
TRM Labs has specifically highlighted similarities between the two operations, strengthening its assessment that the same North Korean-linked hacking network could be involved.
The pattern is particularly concerning because cryptocurrency theft offers North Korea a potential route to acquire funds outside conventional financial systems, which are heavily restricted by international sanctions.
Binance moves to freeze billions in stolen cryptocurrency
Following the discovery of the attack, Binance launched efforts to track the stolen funds and prevent hackers from converting them into other assets or moving them beyond the reach of investigators.
The exchange said it was working with blockchain partners to freeze approximately $3 billion in affected cryptocurrency.
Its response involved coordination with law enforcement agencies, cryptocurrency issuers, blockchain intelligence companies and other industry participants.
Binance said in a statement that it had begun recovering affected assets for users and would continue working with its partners to trace, freeze and recover additional funds.
The exchange also said it had reserved more than $6.34 billion in company funds to cover the incident. Of this amount, approximately $5 billion was held in the same token assets that were affected by the attack.
However, freezing cryptocurrency does not automatically mean that the money has been returned to its rightful owners. It merely prevents the affected assets from being transferred or used, depending on the intervention available to the relevant issuer or platform.
The attackers also attempted to move some of the stolen funds through different cryptocurrencies and trading platforms, complicating recovery efforts.
Bitcoin and cryptocurrency markets react to the massive hack
News of the Binance heist sent jitters through cryptocurrency markets, with investors concerned about the security of digital assets held on centralised exchanges.
Bitcoin fell approximately 4% to $77,465 following reports of the attack. Ethereum also registered a decline of around 6%, while several other major cryptocurrencies came under pressure.
BNB, the native cryptocurrency associated with Binance, fell approximately 1%.
The reaction highlighted how a security incident involving one major exchange can affect sentiment across the wider cryptocurrency ecosystem.
The incident also raises uncomfortable questions about the security of platforms that collectively hold billions of dollars worth of customer assets. Even the world’s largest cryptocurrency exchange is not immune to sophisticated cyberattacks.
Unlike conventional banking transactions, cryptocurrency transfers are generally irreversible once confirmed on a blockchain. Recovering stolen assets therefore depends heavily on tracking transactions, identifying wallets and coordinating with issuers or other entities capable of freezing funds.
If TRM Labs and Chainalysis are correct about the identity of the suspected attackers, the Binance incident would mark another major chapter in North Korea’s campaign of cryptocurrency thefts.
Investigators are now working to establish the full extent of the breach, identify the attackers and recover the affected assets. But one thing is already clear: the theft of $6.3 billion has exposed the enormous financial stakes involved in cryptocurrency security and the growing capabilities of state-linked cybercriminal networks.
