FBI confirms North Korea’s $6.3 billion crypto heist from Binance
3 billion cryptocurrency theft from Binance to North Korea’s TraderTraitor hacking group, citing blockchain analysis firms TRM and Chainalysis. Binance said it would cover 90% of losses using its Secure Asset Fund for Users and corporate reserves.
The FBI on October 30, 2026, attributed a record $6.3 billion cryptocurrency theft from Binance to North Korea’s TraderTraitor hacking group, citing blockchain analysis firms TRM and Chainalysis. Binance said it would cover 90% of losses using its Secure Asset Fund for Users and corporate reserves.
Key numbers
| Stat | Figure | Date | Source |
|---|---|---|---|
| $6.3 billion | $6.3 billion | October 29, 2026 | The Guardian |
| 90% of losses covered | 90% | October 30, 2026 | The Guardian |
| Assets frozen | $3 billion | October 30, 2026 | Reuters |
| Remaining stolen funds | $3.3 billion | October 30, 2026 | Reuters |
| Stablecoins frozen | $1.57 billion | October 30, 2026 | BBC News |
| Registered users | 335 million | 2025 annual report | Reuters |
| Assets under custody | $162.8 billion | 2025 annual report | Reuters |
What happened
On October 29, 2026, hackers stole $6.3 billion in cryptocurrency from Binance in what the FBI later confirmed was an attack by North Korea’s TraderTraitor group, a unit linked to the Lazarus Group. The theft occurred over 20 minutes, with stolen assets moving across multiple blockchains before being laundered through decentralized finance services.
Binance initially suspended all withdrawals and deposits, but resumed withdrawals in phases on November 1, 2026, after freezing $3 billion of the stolen funds. The company said it would cover 90% of losses using its $1 billion Secure Asset Fund for Users, Futures Insurance Fund, and corporate treasury reserves, totaling $6.34 billion. The remaining 10% of stolen assets, valued at $3.3 billion, are less liquid and may take longer to recover.
The FBI stated that the attack involved a compromised laptop belonging to a Binance engineer, which allowed hackers to bypass normal transaction approval controls and drain funds from a hot wallet. The FBI also noted that the hackers used self-destruct mechanisms to delete evidence of their activity, complicating investigations.
Who is affected
Binance’s 335 million registered users globally are directly affected, though the company has pledged to cover all losses. Stablecoin issuers Tether, Circle, and World Liberty Financial froze assets linked to the hack, including $1.57 billion in Tether and $800 million in Circle. Binance’s BNB token and other cryptocurrencies also saw significant price drops, with Bitcoin falling nearly 5% and Ethereum dropping nearly 6%.
The broader crypto industry faces heightened scrutiny over security, with analysts warning that the incident could erode trust in centralized exchanges. Binance’s US subsidiary, Binance.US, was unaffected, but the global incident has raised questions about the resilience of crypto infrastructure.
How the hack unfolded
- October 29, 2026: Hackers steal $6.3 billion from Binance in a 20-minute attack, moving assets across multiple blockchains.
- October 30, 2026: FBI confirms North Korea’s TraderTraitor group as the perpetrator; Binance suspends withdrawals and deposits.
- October 30, 2026: Binance freezes $3 billion of stolen funds; stablecoin issuers Tether and Circle freeze $1.57 billion and $800 million, respectively.
- November 1, 2026: Binance resumes withdrawals in phases; pledges to cover 90% of losses using its Secure Asset Fund for Users.
What to do next
Binance users should monitor official updates from the company, as withdrawals are being resumed in phases to ensure stability. Stablecoin holders should check if their assets were frozen by Tether, Circle, or other issuers. Investors may consider diversifying holdings across multiple exchanges to mitigate risk, though Binance has assured users that all losses will be covered.
Law enforcement agencies, including the FBI and US Secret Service, are actively working to trace and recover stolen funds. Binance has also pledged to cooperate with investigations and strengthen its security protocols.
What we know and don’t know
We know the FBI has confirmed North Korea’s TraderTraitor group as the perpetrator, the attack began with a compromised laptop, and Binance has set aside $6.34 billion to cover losses. However, the full extent of the stolen assets—particularly the $3.3 billion in less liquid tokens—remains unclear, as does the exact method of laundering used by the hackers.
We also don’t yet know whether all frozen assets will be successfully recovered or if additional regulatory scrutiny will follow for Binance or the broader crypto industry.
Why it matters
The fallout could also accelerate a shift toward decentralized finance (DeFi) platforms, which are harder to target but may lack the same user protections as traditional exchanges.
Frequently asked questions
Will Binance users lose money?
No. Binance has pledged to cover all losses, using its Secure Asset Fund for Users, Futures Insurance Fund, and corporate reserves totaling $6.34 billion. The company has assured users that no financial impact will result from the incident.
How did the hackers gain access?
Initial investigations suggest the attack began with a compromised laptop belonging to a Binance engineer. Hackers then used malicious software to bypass transaction approval controls and drain funds from a hot wallet. The FBI confirmed the involvement of North Korea’s TraderTraitor group.
Are other exchanges at risk?
All centralized exchanges face similar risks, though Binance’s scale makes it a prime target. The incident has prompted calls for stronger security protocols across the industry. Decentralized finance (DeFi) platforms may become more attractive as a result, though they offer different trade-offs in terms of user protections.
How much of the stolen funds has been recovered?
Binance has frozen $3 billion of the stolen funds, but the remaining $3.3 billion—particularly the less liquid tokens—may take longer to recover. Stablecoin issuers like Tether and Circle have also frozen assets linked to the hack, totaling $1.57 billion and $800 million, respectively.
What is TraderTraitor?
TraderTraitor is a North Korean hacking unit linked to the broader Lazarus Group, which has been responsible for multiple large-scale crypto heists, including a $1.5 billion attack on a Tokyo exchange in 2025. The group operates as part of North Korea’s state-sponsored cybercrime operations.
Will Binance face legal consequences?
Binance has not been accused of wrongdoing in this incident. However, the company may face increased regulatory scrutiny as a result of the breach. Users who wish to pursue legal recourse for potential contract violations would need to review their agreements with Binance.
See what America is searching today →
Sources
- Binance says 90% of losses from $6.3bn hack covered as FBI says North Korea behind attack — theguardian.com, 2026-11-01
- North Korean group blamed for record $6.3bn Binance hack — hirunews.lk
- Hackers steal $6.3 billion from Binance in record heist blamed on North Korea — detroitnews.com, 2026-10-30
- 'Largest cryptocurrency heist in history' sees $6.3bn stolen by elite North Korean hackers — lbc.co.uk, 2026-10-30
- Crypto giant Binance attempting to recover $6.3bn stolen in hack linked to North Korea — bbc.co.uk, 2026-10-30