Binance lost $6.36 billion to a hack on Oct. 29, 2026. TRM Labs calls it the largest crypto theft on record1. TraderTraitor, North Korea's state hacking unit, gets the blame from the blockchain tracing firm. The FBI named the same unit for last year's $1.5 billion Bybit raid. Binance itself stops short of naming the attacker3.
North Korea's Binance Theft Hit $6.36 Billion on Oct. 29, 2026, Four Times Its Bybit Haul
Dollar value of two thefts TRM Labs ties to North Korea's TraderTraitor unit, by the year each hit
- Binance, Oct. 2026: $6.36B
- Bybit, Feb. 2025: $1.5B
Source: TRM Labs [1].
Read the chart as a table
| Item | Value | Note |
|---|---|---|
| Bybit, Feb. 2025 | $1.5B | The FBI tied TraderTraitor to this $1.5 billion theft |
| Binance, Oct. 2026 | $6.36B |
How TRM Traced the Theft to Pyongyang
Binance keeps most of its crypto in a hot wallet. A hot wallet stays linked to the internet, so it can fill trades fast. That same link makes it a target. TRM Labs traced the theft across ten blockchains, with Ethereum alone losing about $3.79 billion1.
Bitcoin made up $1.47 billion of the haul, or 18,270 coins. Tron lost about $628 million. The XRP Ledger lost $296 million. Solana lost $96 million, and Avalanche and Polygon lost a combined $38 million1.
The theft ran in stages. Small Tornado Cash withdrawals funded the attacker's wallet starting the morning of Oct. 28, TRM says. The XRP Ledger theft hit at 20:05 UTC on Oct. 29. Fifteen minutes later, the attacker swept Ethereum funds with 50 pre-signed EIP-7702 authorizations. EIP-7702 is a feature that lets one signed message hand a wallet's control to another contract. A second wave hit Avalanche and Polygon at 23:05 UTC1.
Cybersecurity researcher Kok Tin Gan read the Ethereum sweep the same way. “This looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet,” said Gan, cofounder and chief executive of the security firm NyxLab4.
TRM calls its own case strong. “TRM attributes the attack to TraderTraitor, North Korea's elite hacking unit, based on robust on and off-chain intelligence,” the firm wrote1. TRM points to the same staging pattern behind the 2025 Bybit hack and April's KelpDAO hack. Chainalysis reached North Korea on its own tracing. Co-founder Jonathan Levin told reporters the hack was "likely done" by TraderTraitor too, CBS News reported4.
TraderTraitor sits inside a bigger structure. CBS News reports that researchers place the unit inside the Lazarus Group, North Korea's wider hacking apparatus4. The same staging pattern now spans three incidents in two years: Bybit in 2025, KelpDAO in April, and Binance in October. A single playbook, reused three times, turns a one-off breach into a program.
Both sides, in their own words
Does a record measured in dollars still hold once bitcoin's price moves again?
“When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity”
“Saw a few discussions about size of hack, why impact to bitcoin price is small, etc. $6.3 billion is the biggest in USD terms, but not in BTC terms. MtGox was 650,000 BTC!”
Binance Scrambles to Stop the Bleeding
News of North Korea's role spread fast online. A post from Watcher.Guru naming the country drew nearly 27,900 likes within hours13.
Watcher.Guru@WatcherGuruJUST IN: North Korea's $6,300,000,000 Binance crypto hack is the largest heist in human history. pic.twitter.com/6MQu8AkYAa
Binance, meanwhile, pointed to a quieter cause for the opening. A compromised DevOps engineer's laptop let the attacker reach a service container and send unauthorized withdrawals, the exchange said9.
Co-chief executive Richard Teng says the job took more than one trick. “The attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action. It involved a more complex attack process,” Teng said2. Binance's self-destruct mechanism, built to kill rogue sessions, destroyed some of the attacker's tooling once staff spotted the breach8.
Five parties froze about $2.7 billion of the stolen funds by 00:30 UTC on Oct. 30. Tether froze 1.77 billion USDT. Circle froze 825 million USDC. Ripple froze 40.5 million RLUSD, and World Liberty Financial froze 27.8 million USD1. The Arbitrum Security Council froze 8,426 ETH and 74.6 million ARB, worth about $30 million1.
The attacker still holds the rest. TRM counts more than 420,000 ETH and 18,270 BTC in the attacker's wallets, worth about $2.4 billion1.
Five Firms Froze $2.7 Billion of Binance's Theft by Oct. 30, 2026
The theft split between frozen funds and funds the attacker still holds, in billions of dollars
- Frozen by Tether and four others: $2.7B
- Still held by the attacker: $2.4B
- The rest of the theft, apart from those two counts: $1.26B
Source: TRM Labs [1].
Read the chart as a table
| Item | Value |
|---|---|
| Frozen by Tether and four others | $2.7B |
| Still held by the attacker | $2.4B |
| Whole | $6.36B |
Binance pledged its own cash for whatever freezing missed. “We are committed to covering all hacked losses through our company funds. Your assets are safe,” Teng said in a video posted Oct. 308. Binance set aside $6.34 billion and aimed to restart withdrawals within about 48 hours2.
DeFi felt the aftershock too. Aave's guardians froze 175 reserves across 16 networks on its newer markets. Its guardians froze 117 more across four networks on its older markets, hours after the theft10. “We also track the exploiter in real time. We follow every wallet in its cluster on Ethereum, Arbitrum, Optimism and Avalanche,” the protocol said.
The crisis still left room for a joke. Elon Musk mocked Binance online as the news spread. Zhao asked him to ease up, pointing to Binance's stake in Musk's SpaceX. “Elon, have a lot of respect for you, but bad time to troll. Please stop,” Zhao wrote7. Co-chief executive Yi He added that the exchange's yearly revenue alone could cover the loss, so Binance would skip selling its SpaceX shares6.
CZ Reframes the Record in Bitcoin Terms
Zhao disputes part of the record claim. “Saw a few discussions about size of hack, why impact to bitcoin price is small, etc. $6.3 billion is the biggest in USD terms, but not in BTC terms. MtGox was 650,000 BTC!” he posted on Oct. 305.
CZ 🔶 BNB@cz_binanceSaw a few discussions about size of hack, why impact to bitcoin price is small, etc. 👇
$6.3 billion is the biggest in USD terms, but not in BTC terms. MtGox was 650,000 BTC!
Other important numbers to consider:
% of bitcoin (in relation to BTC total supply), ie, market… https://t.co/orRORPjFcM pic.twitter.com/Lqgd4RJzSj
Mt. Gox, a Tokyo exchange, lost 650,000 bitcoin in 2014. Bitcoin traded for a few hundred dollars back then. Binance's theft tops Mt. Gox's heist only once each coin gets priced at today's rate. Bitcoin sold near $76,889 at 22:49 UTC on Oct. 30, down about 2.5% on the day11.
Dollars still set crypto's usual yardstick, since one bitcoin buys a different amount each year. By that measure, TRM's count holds. Its $6.36 billion beats every theft the firm has tracked, Bybit included1.
Binance stops short of backing TRM's finding with its own name for the attacker. "Our investigation has not attributed responsibility to any individual," Teng told Al Jazeera3. TRM and Chainalysis reached North Korea through their own tracing, apart from Binance's probe. Binance has let both firms' findings stand unchallenged14.
What a Compliance Desk Should Flag
The theft lands hardest on North Korea's own ledger. “When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity,” said Ari Redbord, TRM's global head of policy3.
Exchanges face a renewed warning too. “Any assets held at a centralised exchange are only as safe as the exchange itself, and the larger the exchange's holdings, the larger a target it becomes,” said Sean Foley, a crypto markets expert at Macquarie University in Sydney3.
Money can buy back trust fast. Certainty about who strikes next takes longer to earn, and TRM's tracing alone leaves that question open.
A legal team reading this case gets one clear signal and one open one. TRM and Chainalysis built the North Korea case from on-chain patterns. That is the kind of evidence the house standard asks for before anyone uses the word exploit. Binance's own account of the cause names the laptop and the service container. That account still lacks the one document that would close the file: a charge, a filing or a court record naming a person.
By the numbers
- TRM Labs calls the $6.36 billion Binance theft crypto's largest ever, recorded Oct. 29, 20261.
- Five parties froze $2.7 billion of the haul by 00:30 UTC on Oct. 30: Tether, Circle, Ripple, World Liberty Financial and the Arbitrum Security Council1.
- More than 420,000 ETH and 18,270 BTC, worth about $2.4 billion, still sits in the attacker's wallets, TRM says1.
- The FBI tied the same North Korean unit to Bybit's $1.5 billion theft in February 20251.
- Fifty pre-signed EIP-7702 authorizations moved the Ethereum funds in one burst1.
- Bitcoin traded at $76,889 at 22:49 UTC on Oct. 30, down about 2.5% on the day11.
- BNB traded at $699.23 the same hour, little changed on the day12.
- Binance set aside $6.34 billion of its own cash to cover the loss8.
What to watch
Binance plans a full reserves report on Nov. 2, 2026. The filing should show whether the $6.34 billion Teng promised sits where he says it does8. A later statement naming the attacker, or a criminal charge, would turn TRM's finding into Binance's own record3. Other exchanges can study Aave's fast freeze as a guide. Spot the same EIP-7702 pattern early, and a protocol can block it within hours10.
Sources
- TRM Labs, "North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History," Oct. 30, 2026, https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history
- Ravie Lakshmanan, "Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen," The Hacker News, Oct. 30, 2026, https://thehackernews.com/2026/10/binance-suffers-security-breach.html
- Nils Adler, "Binance says $6.3bn stolen in biggest crypto heist in history: What we know," Al Jazeera, Oct. 30, 2026, https://www.aljazeera.com/news/2026/10/30/binance-says-6-3bn-stolen-in-biggest-crypto-heist-in-history-what-we-know
- "Blockchain analysis firm TRM says North Korea behind Binance crypto theft," CBS News, Oct. 30, 2026, https://www.cbsnews.com/news/binance-hack-north-korea/
- Changpeng Zhao, "$6.3 billion is the biggest in USD terms, but not in BTC terms. MtGox was 650,000 BTC!," X (@cz_binance), Oct. 30, 2026, https://x.com/cz_binance/status/2116198836729520420
- Jose Antonio Lanz, "Elon Musk, CZ Trade Blows Over SpaceX Shares After $6.4B Binance Hack," Decrypt, Oct. 30, 2026, https://decrypt.co/382236/elon-musk-cz-trade-blows-spacex-shares-binance-hack
- Olivia Stephanie, "CZ fires back at Elon Musk over Binance hack jokes, cites $1B SpaceX stake," crypto.news, Oct. 30, 2026, https://crypto.news/cz-elon-musk-stop-trolling-binance-hack/
- "Binance Sets Aside $6.34B to Cover Hack Losses, CEO Says 'Your Assets Are Safe'," Decrypt, Oct. 30, 2026, https://decrypt.co/382237/binance-sets-aside-6-34b-to-cover-hack-losses-ceo-says-your-assets-are-safe
- Alex Lekander, "Binance links $6.3 billion security incident to compromised laptop," Cyberinsider, Oct. 29, 2026, https://cyberinsider.com/binance-security-incident-6-3-billion/
- "Binance Hack Fallout: Aave Freezes Lending Across 16 Networks," Bitcoin.com News, Oct. 30, 2026, https://news.bitcoin.com/defi/binance-hack-fallout-aave-freezes-lending-across-16-networks/
- CoinGecko, "Bitcoin (BTC) price in US dollars," Oct. 30, 2026, https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=usd&include_24hr_change=true
- CoinGecko, "Binance Coin (BNB) price in US dollars," Oct. 30, 2026, https://api.coingecko.com/api/v3/simple/price?ids=binancecoin&vs_currencies=usd&include_24hr_change=true
- Watcher.Guru, "JUST IN: North Korea's $6,300,000,000 Binance crypto hack is the largest heist in human history," X (@WatcherGuru), Oct. 30, 2026, https://x.com/WatcherGuru/status/2116175386916897161