In late October 2026, the cryptocurrency exchange Binance lost about $6.3 billion in digital assets within minutes. It is the biggest theft in crypto history, and the FBI attributes it to North Korea. Binance says its customers will be reimbursed. Here is what we know, where sources disagree, and what the case means for companies and users.
What happened
Sources disagree on the exact day. The Register dates the attack to October 29, while Al Jazeera places it on Friday, October 30. Either way, the theft was very fast: according to TRM Labs, cited by The Register, most of the funds vanished in about 20 minutes. Binance then suspended withdrawals, and several cryptocurrencies fell the same day, as Al Jazeera reported. Co-CEO Richard Teng called it a “complex attack”.
The amount itself varies. Binance acknowledges about $6.3 billion, but, as The Register noted, TRM Labs puts it at $6.36 billion and Elliptic at $6.43 billion. PBS NewsHour and Al Jazeera both describe it as the largest crypto theft ever recorded, well ahead of the $1.5 billion Bybit hack in February 2025.
How the attackers got in
Binance says it all began with the compromise of a DevOps engineer’s laptop. According to The Register, that access gave the intruders control of a service container, which they then used to authorize withdrawals. In its weekly roundup, This Week in Security noted that Binance had first blamed that laptop and was still investigating “additional points of breach”.
That account comes from Binance itself. As The Register points out, the FBI alert does not describe the technical entry point, and the article does not detail the evidence behind the FBI’s attribution either.
Who is behind it
The FBI published an alert on Saturday, October 31. It attributes the attack to TraderTraitor, a North Korean operation linked to the Lazarus Group, according to The Register. The FBI also ties it to the $1.5 billion Bybit theft, as Al Jazeera recalled, and The Register adds that TraderTraitor was already linked to the $308 million DMM Bitcoin theft in 2024. Analysts at TRM Labs and Elliptic also point to North Korea.
TraderTraitor is known for fake job offers and fake recruitment exercises used to trick employees into giving access to their employer’s systems, as The Register explained. Binance has not said its engineer was targeted this way. According to PBS, President Donald Trump said on Saturday night that investigators did not yet know whether North Korea was involved, even though the FBI had already named it earlier that day.
Laundering: where the money goes
The FBI published a list of wallet addresses tied to the theft and asked exchanges and blockchain analytics firms to block related transactions. According to its investigation, the hackers are mostly converting the stolen assets into Ethereum, before moving through decentralized finance (DeFi) platforms and instant swap services, as The Register and PBS explained.
Ari Redbord of TRM Labs expects the funds to be split up and laundered through smaller exchanges, which could take months, but he stressed that they stay traceable in real time, which could help recover some of them, he told PBS. Elliptic says it has verified that about $2.85 billion of the stolen assets have already been frozen or seized, according to The Register.
What about Binance customers?
According to Al Jazeera, Binance said on Saturday, October 31, that it had replaced 90% of the stolen assets by buying tokens with company funds: a $1 billion Secure Asset Fund for Users (SAFU), a bitcoin reserve, part of its futures insurance fund and corporate treasury. The remaining 10%, less liquid, is to follow. The platform also published a new proof of reserves, meant to show that customer assets are backed at least one to one. CNBC headlined that Binance had resumed withdrawals while saying 90% of stolen user assets were covered.
In an article dated November 2, The Register reported that Binance was talking about roughly 95% of assets replaced, with the last tokens harder to buy because of limited liquidity. It adds that this figure is not comparable with Elliptic’s $2.85 billion frozen or seized, which measures something else. Withdrawals reopened in phases, with about $3.64 billion in net outflows, or 2.1% of the platform’s reported assets, according to The Register. Richard Teng promised that customers would not be left footing the bill.
What is still unknown
- The exact date: October 29 or 30 depending on the source.
- The final amount: between $6.3 and $6.43 billion depending on who is counting.
- The entry point: a compromised engineer’s laptop is Binance’s version, not confirmed by the FBI, and investigators are looking for other weaknesses.
- How much is recoverable: frozen funds, funds replaced by Binance and funds lost for good are three different things.
What companies can take from this
What follows is our own analysis, not that of the sources cited. If Binance’s account holds, a single compromised workstation was enough to reach a container able to authorize withdrawals worth billions. The measures to look at first are classic, but rarely applied all the way:
- Separate administration workstations from everyday use (email, browsing) and limit the access they grant.
- Restrict the rights of containers and service accounts: none should be able to approve a critical operation alone.
- Require several independent approvals for very high-value operations, with caps and delays.
- Monitor abnormal flows and be able to cut withdrawals automatically on a spike.
- Train technical teams on fake recruiters and code “exercises” sent by strangers.
If you have a Binance account
Binance says customers will be reimbursed. In this context, be wary of emails and messages promising “compensation” or asking you to “verify” your account: such campaigns always feed on the news. Never open a link you receive, go through the official app or type the official address yourself, enable strong authentication and the anti-phishing code the platform offers, and never share your recovery phrases.
Frequently asked questions about the Binance hack
About $6.3 billion according to Binance. TRM Labs says $6.36 billion and Elliptic $6.43 billion.
The FBI names TraderTraitor, a North Korean operation linked to the Lazarus Group. TRM Labs and Elliptic point the same way.
Binance says a DevOps engineer’s laptop was compromised, giving access to a service container able to authorize withdrawals. The FBI has not confirmed this account.
Binance says no. It says it replaced roughly 90 to 95% of the stolen assets with its own funds and promises customers will not pay the bill.
Partly. Elliptic counts about $2.85 billion frozen or seized, and TRM Labs says the funds remain traceable, but laundering could take months.
