North Korean Hackers Accused of $6.3 Billion Crypto Theft in Binance Security Breach

Image: TechCrunch · Source

A cyberattack on Binance, attributed to North Korean hackers, led to the theft of $6.3 billion in cryptocurrency through a compromised employee laptop. About half of the stolen funds have been frozen, and Binance has suspended all deposits and withdrawals pending investigation.

On October 30, 2026, the world's largest cryptocurrency exchange, Binance, revealed it suffered the largest known crypto theft in history, with hackers stealing at least $6.3 billion in digital assets. Security researchers traced the attack to a North Korean hacker group known as TraderTraitor, a cell reportedly focused on targeting large crypto exchanges.

Binance stated the breach occurred after attackers compromised a laptop belonging to one of its engineers. This access allowed the hackers to infiltrate a service container and submit unauthorized withdrawal transactions from Binance's wallets. Despite the severity of the breach, Binance noted there was no evidence that its private cryptographic keys were exposed, which would have enabled unrestricted control over its assets.

In response to the incident, Binance has suspended all deposits and withdrawals as it investigates the intrusion. The company assured users that funds remain safe and pledged to release a verified proof of reserves once remediation efforts conclude. Industry partners have already frozen roughly $3 billion of the stolen cryptocurrency as they continue tracking and recovering assets.

Security experts from TRM Labs and Elliptic attributed the theft to the North Korean group, marking this as the largest crypto heist linked to state-sponsored hackers. This group also executed a prior $1.4 billion theft from Bybit exchange in 2025. Analysis showed the stolen funds moved rapidly across multiple blockchains, taking just about 20 minutes to complete the transfers, including some going to wallets linked to earlier attacks like the $351 million Bitget hack.

The U.S. government and international allies have long warned that North Korea uses cybercrime to bypass sanctions and fund its weapons programs, with cryptocurrency theft now a prominent tactic.

While Binance faces scrutiny over how a single employee's laptop could grant access to billions in funds, details about the exact method of compromise remain sparse. The company has declined to comment on whether it conducted third-party security audits before the breach. As investigations continue, Binance collaborates with law enforcement and blockchain intelligence firms to recover assets and bolster defenses against future breaches.