FBI says North Korea was behind the theft Binance puts at about $6.3 billion

Binance, the crypto exchange, estimated that about $6.3 billion in crypto assets was stolen from its wallets on 29 October 2026, according to CoinDesk and Reuters. Estimates from blockchain analytics firms differ: TRM Labs said about USD 6.36 billion moved out of Binance wallets across ten blockchains, valued at prices when each transfer happened, Elliptic said $6.43 billion in crypto assets was stolen, and Chainalysis said in an analysis published on 30 October that about $6.4 billion left in unauthorized transfers. TRM Labs said most of the outflows happened in about 20 minutes. Reuters, citing analysts, and CoinDesk described it as the largest crypto hack on record.

Binance said its initial investigation indicated that the breach started with a compromised engineer's laptop. According to Binance, this gave the attacker access to an internal system, which the attacker then used to send withdrawals that Binance had not authorised. Binance suspended withdrawals while it investigated, and said it expected to resume them within 48 hours, according to Reuters. Binance also said it was working with law enforcement partners, according to Al Jazeera and CoinDesk; it did not name any agency. It said user funds are safe and that it would cover the losses from company funds and its emergency asset fund, known as SAFU (Secure Asset Fund for Users). On 30 October, Binance said it had set aside more than $6.34 billion to cover the losses, with about $5 billion already held in the affected tokens, and that it was buying the rest on public markets and over the counter, according to CoinDesk. Binance said these figures do not include frozen assets. Binance also said it had found additional exploit points beyond the compromised laptop, without giving details, and that it had seen no evidence that wallet private keys were stolen, according to CoinDesk. Withdrawals were still paused and deposits remained open, CoinDesk reported. In a video posted on X on Friday 30 October, co-chief executive Richard Teng said Binance hoped to restore withdrawals before Sunday, according to The Block. Teng also said the exchange was aiming to publish its first proof-of-reserves report on Monday, The Block reported. The FBI said in a statement that it was aware of the incident and was engaged with relevant public and private partners, according to Reuters and Nextgov/FCW. On 31 October, Binance said it had replenished 90% of the stolen assets, according to Reuters and CoinDesk. Binance said the remaining 10% was made up of less liquid tokens that may take longer to buy, according to Reuters and CoinDesk. Binance said it remained on track to reopen withdrawals on Sunday 1 November, according to CoinDesk.

Binance said about $3 billion of the stolen assets had been frozen with the help of partners, according to Reuters and CoinDesk. TRM Labs reported lower counts: a Binance figure of USD 2.54 billion at 23:35 UTC on 29 October and its own total of about USD 2.7 billion at 00:30 UTC on 30 October. Circle, which issues the USDC stablecoin, said it froze more than $800 million of USDC, according to Reuters and CoinDesk. Reuters and CoinDesk reported that Tether, which issues USDT, froze about $1.57 billion of USDT, while TRM Labs put Tether's freezes at about 1.77 billion USDT. Chainalysis said about $2.8 billion had been frozen so far. Elliptic said it had verified $2.84 billion in frozen funds, and that stablecoins made up 94% of the frozen funds. A stablecoin issuer can freeze its tokens at a specific address, so stolen stablecoins are easier to stop than assets such as bitcoin or ether.

On 31 October, the FBI said North Korea was responsible for the theft, according to the Associated Press (AP) and AFP. The FBI linked the attack to TraderTraitor, a North Korea-linked hacking group that AP and AFP said was also behind the roughly $1.5 billion theft from the Bybit exchange in February 2025. The FBI said it had seen TraderTraitor converting stolen assets into ether, and that it expected the group to try to launder them further through decentralised finance (DeFi) platforms and instant swap services, according to AP and AFP. The FBI urged private-sector firms to block transactions linked to the addresses the group uses to launder the funds, AP and AFP reported; AP said this included crypto exchanges and blockchain analytics firms. AMLift could not access the FBI's own alert. Before the FBI statement, TRM Labs said it assessed with high confidence that TraderTraitor carried out the attack, and Chainalysis also assessed that TraderTraitor was responsible. Chainalysis said its strongest evidence was seeing funds stolen from Binance mixed with funds from last month's exploit of the Bitget exchange, which had been attributed to North Korean actors. Elliptic said it was likely that North Korea-linked actors carried out the theft. According to TRM Labs, the attacker began converting stolen stablecoins into ether and used lending protocols, including Aave and JustLend, to move value. Elliptic said the 18,270 bitcoin taken had been split across 19 addresses and that none had yet been sent to a service.