Binance Hack Explained: The $6.3 Billion Heist Blamed on North Korea

WarBrief Live | October 31, 2026 | Cyber Warfare

On October 29, 2026, attackers moved about $6.36 billion out of Binance wallets in roughly 20 minutes. Analysts at TRM Labs blame North Korea’s TraderTraitor unit; no government has confirmed that attribution, and Binance has named no culprit.

The Binance hack is now the largest cryptocurrency theft on record — and, if the attribution holds, the most lucrative single operation in North Korea’s state hacking programme.

What happened to Binance on October 29?

The theft began at 20:05 UTC on October 29, 2026, when Binance-controlled wallets across ten blockchains — including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger — started sending their balances to addresses controlled by a single attacker. According to TRM Labs, which tracked the flows on-chain, approximately $6.36 billion moved in total, most of it in about 20 minutes. The Ethereum leg alone accounted for roughly $3.79 billion, alongside 18,270 bitcoin (about $1.47 billion) and around $628 million on Tron.

Binance confirmed a security incident and suspended withdrawals on several networks. Then the race to freeze the money began: stablecoin issuers and operators — Tether, Circle, Ripple, World Liberty Financial and the Arbitrum Security Council among them — froze addresses holding stolen assets. Binance and Reuters reporting put the frozen total at about $3 billion, including roughly $1.57 billion frozen by Tether and more than $800 million by Circle. TRM’s own count is slightly lower, about $2.7 billion frozen, with an estimated $2.4 billion — including more than 420,000 ether and the 18,270 bitcoin — still in the attacker’s hands.

For customers, the exchange’s message was simple: Binance says user funds are safe and that all losses will be covered by its SAFU insurance fund and company funds, with withdrawals expected to resume once a security review is complete. The market reaction was sharper: Bitcoin fell about 4.5% and Binance’s BNB token about 7% as the news spread (The Block, reporting CoinGlass data).

• October 27, 2026: Binance says it has blocked North Korea-linked fake job-interview attacks aimed at its staff.
• October 28–29: Small, discreet withdrawals begin — TRM assesses these as rehearsals, with preparation starting at least 36 hours earlier.
• October 29, 20:05 UTC: The main drain: about $6.36 billion leaves Binance wallets on ten blockchains, most within roughly 20 minutes.
• October 29–30: Issuers freeze about $2.7–3 billion; Binance pledges to cover all losses.
• October 30: TRM Labs publishes its attribution to TraderTraitor; Chainalysis and Elliptic reach the same conclusion.

How did the attackers get into Binance?

Binance’s initial finding is a human, not cryptographic, failure. The exchange says the attackers compromised a DevOps engineer’s laptop, used that access to reach a service container, and submitted unauthorized withdrawal transactions. It stresses that it found no evidence that wallet private keys leaked — the attackers did not break Binance’s cryptography; they got inside its operational machinery and made the machinery sign.

TRM’s on-chain reconstruction fills in the Ethereum side of that picture. The firm says the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a “sweeper” it controlled, armed with 50 pre-signed authorizations prepared in advance and then executed in one burst. That is why the drain was so fast: the signatures were gathered first, and the money moved second.

The laptop route also matches the accused unit’s known playbook. An April 2022 joint advisory from the FBI, CISA and the US Treasury Department (AA22-108A) warned that TraderTraitor campaigns begin with recruitment-style lures — fake job offers and trojanized cryptocurrency applications aimed at system administrators and DevOps staff. Binance’s October 27 disclosure fits that pattern closely. One caution matters: there is no public evidence linking that blocked campaign to this breach, and neither Binance nor TRM has claimed otherwise. It is context, not a confirmed entry route.

Who is TraderTraitor, the unit analysts blame for the Binance hack?

TraderTraitor is not a brand the hackers chose for themselves. It is the name the US government — first in the FBI, CISA and Treasury advisory of April 2022 — gives to a cluster of North Korean state-sponsored cyber activity targeting cryptocurrency companies. Private firms track the same activity as Jade Sleet, Slow Pisces and UNC4899. It sits under the wider Lazarus Group umbrella: North Korean state hackers controlled, according to the US Treasury, by the Reconnaissance General Bureau, Pyongyang’s primary foreign intelligence service. The Treasury sanctioned Lazarus and its sub-groups Bluenoroff and Andariel in September 2019.

The group’s confirmed record explains why analysts reached for its name within a day of the Binance theft:

• Bybit, February 2025 — $1.5 billion. Five days after the theft, the FBI issued public service announcement I-022625-PSA stating that North Korea, through TraderTraitor, was responsible, and published laundering addresses for the industry to block. Read the FBI’s Bybit attribution.
• DMM Bitcoin, May 2024 — $308 million. The FBI, the US Department of Defense Cyber Crime Center and Japan’s National Police Agency linked the theft of about 4,503 bitcoin to TraderTraitor; the intrusion began at a wallet-software supplier.
• The method: social engineering first, cryptography never. Fake recruiters, fake companies and malware-laced trading apps — aimed at the engineers who hold the keys.

TRM says the Binance operation carried the same signatures: small withdrawals funding an operator wallet, staging well before the theft, and signatures obtained in advance then executed in one burst. Chainalysis chief executive Jonathan Levin assessed the theft was “likely done by DPRK group TraderTraitor due to links to previous hack”, and blockchain investigator ZachXBT described the attacker as “likely Lazarus”. North Korea, for its part, routinely denies involvement in hacking operations.

What is confirmed about the Binance hack — and what is still only analyst attribution?

This distinction is the whole story, so WarBrief Live is keeping it explicit. The theft is confirmed on-chain and by the exchange. The thief’s identity is, so far, an assessment by private analytics firms — a strong one, made independently by three of them, but not a formal attribution by any government.

Caveat: figures reflect reporting as of October 30–31, 2026. Frozen totals differ between Binance/Reuters reporting (about $3 billion) and TRM Labs’ count (about $2.7 billion) because the freeze race was still running.

By the numbers: the Binance hack and North Korea’s crypto war chest

Where does the stolen crypto go?

The laundering pattern is well documented from the Bybit case: the FBI warned that TraderTraitor actors move fast, converting stolen assets into bitcoin and other tokens dispersed across thousands of addresses, precisely so that freezes — which only work on centrally issued tokens like USDT and USDC — arrive too late. TRM reported the Binance attacker already swapping at-risk stablecoins into ether, an asset no issuer can claw back.

The destination is the reason this belongs on a defence desk. The US Treasury has said Lazarus sub-groups were established to generate revenue for the North Korean regime, in part for its nuclear weapons and ballistic missile programmes. The UN Panel of Experts reported in 2024 that malicious cyber activity generates roughly 50% of North Korea’s foreign-currency income and that about 40% of its weapons-of-mass-destruction programmes are funded by illicit cyber means. The US Office of the Director of National Intelligence has assessed that Pyongyang secures at least $1 billion a year through financial crime, cryptocurrency theft among it. Chainalysis put North Korea-linked theft at $2.02 billion in 2025 alone — before one $6.36 billion morning in October 2026 nearly doubled the regime’s cumulative haul of $6.75 billion.

The same state pouring resources into North Korea’s drone dominance push and its missile forces is, on the analysts’ assessment, paying for them partly out of other people’s exchange accounts. That is sanctions evasion at industrial scale: every frozen dollar is a dollar the sanctions architecture clawed back, and every laundered dollar is one it failed to stop. Our explainer on economic sanctions as a tool of modern statecraft sets out why enforcement, not designation, is now the weak link.

What the Binance hack means for US, UK and EU readers

If you hold crypto anywhere: the risk that just materialized was not price volatility — it was counterparty operations. The world’s largest exchange was emptied not by broken cryptography but by one compromised laptop and pre-signed authorizations. Binance’s pledge to cover losses from its SAFU fund mirrors Bybit’s response in 2025, but “the exchange made everyone whole” is a policy choice, not a guarantee. This is educational context, not financial advice.

For markets: a 4.5% bitcoin drop and a 7% fall in BNB within hours show that crypto exchange failures now transmit like banking shocks — fast, leveraged and global. Roughly $1.55 billion in liquidations (CoinGlass data reported by The Block) is the kind of number regulators in Washington, London and Brussels read carefully.

For policy: expect three things. First, stablecoin issuers have become de facto sanctions enforcers — Tether and Circle froze more in an hour than many court systems move in a year. Second, the EU’s MiCA regime and the UK’s crypto rules will face pressure to treat exchange operational security as a prudential issue. Third, if US agencies formally attribute this theft to Pyongyang — as the FBI did with Bybit — expect new designations against laundering addresses and facilitators.

What happens next in the Binance investigation?

The first milestone is attribution. In the Bybit case, the FBI named TraderTraitor five days after the theft; if Washington follows the same tempo, a formal US statement could arrive within days. The difference matters: a government attribution unlocks sanctions designations, indictments and coordinated address-blocking of the kind described in how cybercrime takedowns work.

The second is the money. About $2.4 billion remains in attacker-controlled wallets, and its movement will be tracked in public — the cat-and-mouse discipline described in our primer on the role of cyber intelligence in modern conflict prevention is now playing out on live blockchain data. Every hop toward a mixer, bridge or over-the-counter broker is a chance to freeze, seize or designate.

The third is Binance itself: the exchange has promised a fuller account of the breach and updated proof of reserves. Until that post-mortem lands, the laptop finding remains an initial account, not a final one — and the wider signing-infrastructure failure TRM’s analysis hints at stays an open question.

Frequently asked questions

Who hacked Binance in October 2026?
Blockchain analytics firm TRM Labs attributes the theft to TraderTraitor, North Korea’s elite state hacking unit, “with high confidence”, and Chainalysis and Elliptic reached the same conclusion. That is an analyst attribution: Binance has not named a culprit and no government agency had formally attributed the attack as of October 31, 2026.

How much was stolen in the Binance hack?
About $6.36 billion was moved out of Binance wallets across ten blockchains on October 29, 2026, most of it in roughly 20 minutes — the largest cryptocurrency theft on record. Issuers froze about $2.7–3 billion of it; TRM Labs estimates the attacker still holds about $2.4 billion.

Are Binance user funds safe after the hack?
Binance says yes: user funds are safe, losses will be covered by its SAFU fund and company funds, and it found no evidence of a private-key leak. Withdrawals were suspended during the security review and are expected to resume once it is complete.

What is TraderTraitor?
TraderTraitor is the US government’s name for a North Korean state-sponsored hacking campaign targeting cryptocurrency firms, first described in an April 2022 FBI, CISA and Treasury advisory. Also tracked as Jade Sleet and Slow Pisces, it operates under the Lazarus Group umbrella and answers to North Korea’s Reconnaissance General Bureau. The FBI has attributed the $1.5 billion Bybit theft (2025) and the $308 million DMM Bitcoin theft (2024) to it.

Why does North Korea steal cryptocurrency?
According to the US Treasury, Lazarus sub-groups were created to generate revenue for the regime, in part for its nuclear weapons and ballistic missile programmes. The UN Panel of Experts estimated that malicious cyber activity provides about 50% of North Korea’s foreign-currency income and funds roughly 40% of its WMD programmes. North Korea routinely denies involvement in hacking.

Sources

• TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History
• Al Jazeera: Binance says $6.3bn stolen in biggest crypto heist in history — what we know
• FBI IC3: Public Service Announcement I-022625-PSA — North Korea Responsible for $1.5 Billion Bybit Hack
• CISA / FBI / US Treasury: Cybersecurity Advisory AA22-108A — TraderTraitor
• FinanceFeeds: Did Lazarus Hack Binance? North Korea Blamed for $6.3B Theft
• SecurityAffairs: $6.3 Billion Stolen from Binance in Attack Attributed to North Korea