Skip to content
NewA calmer, faster ZeroHour
StoryData breachcritical

Binance Hit by $6.3B Crypto Theft Attributed to North Korea

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

North Korean hackers stole $6.3 billion from Binance on October 29, 2026, using a compromised laptop; exchange covering losses from reserves.

On October 29, 2026, attackers stole about $6.3 billion from Binance hot wallets across ten blockchains in under 20 minutes. A compromised DevOps engineer's laptop enabled access to a service container for unauthorized withdrawals, with no private key leak found. The FBI, TRM Labs, and Chainalysis attribute the theft to North Korea's TraderTraitor group. Binance is using company and SAFU funds to cover losses after freezing about $3 billion; deposits resumed while withdrawals are expected to resume within 48 hours.

Key facts
  • Theft of ~$6.3B on October 29, 2026 across 10 blockchains
  • Compromised DevOps laptop enabled withdrawals
  • No wallet private keys stolen
  • North Korea's TraderTraitor blamed by TRM, Chainalysis, FBI
  • ~ $2.7B frozen by issuers and exchanges
  • Attackers hold >$2.4B including 420k ETH and 18k BTC
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Jun 1, 2026Tampered AI coding tool installed on engineer laptop · The Record
  2. Sep 1, 2026Fake job interviews delivered malware to engineer · The Record
  3. Oct 20, 2026Lateral movement began into wallet team · The Record
  4. Oct 29, 2026$6.3B drained from Binance wallets in 20 minutes · Security Affairs
  5. Oct 30, 2026Issuers froze $2.7B in assets · BleepingComputer
  6. Nov 2, 2026FBI flags 608 addresses for laundering · SecurityWeek

What each outlet adds

beyond the shared facts
  • Security AffairsFBI attributes to TraderTraitor and flags laundering addresses
  • BleepingComputerCompromised DevOps laptop for unauthorized withdrawals
  • Dark ReadingEthereum EIP-7702 delegations for hot wallet access
  • The RecordMonths-long campaign with fake jobs and AI tools
  • SecurityWeekFBI release of 608 flagged addresses
Vendors
Binance
Products
binance wallethot walletwithdrawal service
Threat actors
TraderTraitorLazarus GroupAPT38
Victims
Binance
Organizations
NCC GroupFBITetherCircleTRM LabsChainalysisTRMRippleWorld Liberty FinancialEllipticUSSSIRS-CI
Countries
North KoreaUnited States

Coverage

oldest first · one row per article · UTC
  1. · 12d ago The Hacker NewsFirst report

    Binance says incident hit $6.3 billion; nearly $3 billion frozen

    Binance blames a compromised DevOps laptop for unauthorized withdrawals and says SAFU will cover losses.

  2. · 12d ago The Register · Security

    Binance halts trading after laptop compromise tied to $6.3 billion

    Binance says a DevOps laptop led to unauthorized withdrawals, user funds are safe, and no wallet private keys leaked.