Binance hack moves about $6 billion; firms blame North Korean group
Attackers moved roughly $6.3 billion in crypto out of Binance, the world's largest crypto exchange, in what blockchain firms call the biggest crypto theft on record. Binance says it will cover losses and about $3 billion has been frozen; analytics firms tie the attack to a North Korean state-backed group.
AI-assisted · US Brief desk · Sources listed below
What happened
Binance, the world's largest cryptocurrency exchange, suspended deposits and withdrawals after attackers pulled about $6.3 billion in digital tokens from its systems, CNBC and the BBC reported. Blockchain-analytics firm TRM Labs counted about $6.36 billion moved across 10 blockchains, most of it in roughly 20 minutes; Chainalysis put the total at $6.4 billion. That would make it the largest crypto theft on record, about four times the $1.5 billion taken from the Bybit exchange in February 2025.
How it happened, per Binance: The company said a DevOps engineer's laptop (the computer of a staff member who manages its servers) was compromised, which may have let the attacker into a "service container," a sealed-off piece of software running on Binance's systems, and submit withdrawals that were not authorized. Binance said it found no sign that its private keys, the secret codes that control customer wallets, had leaked.
Who pays: Co-CEO Richard Teng confirmed Binance will cover user losses from its SAFU fund (an emergency reserve it set up for this kind of event) and company money, and said it has set aside more than $6.34 billion, including about $5 billion it already held in the affected tokens. Binance's Yi He said withdrawals should start to resume within 48 hours. Stablecoin issuers Circle and Tether and the company Ripple froze tokens tied to the attack, and roughly $3 billion is now frozen, CNBC reported.
Why it matters
A theft of this size tests whether the largest exchange can make customers whole without a run on deposits. For ordinary users, it is a reminder that funds on an exchange depend on that company's security and reserves.
What’s next
Whether Binance reopens withdrawals within its 48-hour target, any FBI statement on attribution, and court actions to claw back frozen funds.
More context
Who did it: TRM Labs said "with high confidence" the attack was the work of TraderTraitor, a North Korean state-sponsored hacking group that the FBI has blamed for the Bybit theft. TRM said preparations began at least 36 hours earlier, with wallets funded through Tornado Cash, a tool that mixes crypto to hide where it came from. Chainalysis CEO Jonathan Levin also pointed to TraderTraitor.
Market reaction: Bitcoin fell more than 4% to below $78,000, and shares of Circle fell about 5% in after-hours trading, CNBC reported. Sean Farrell of the research firm Fundstrat said he sees no meaningful risk to Binance's solvency, estimating that about $3.3 billion remains unfrozen and that the roughly $1.2 billion SAFU fund alone could cover about a third of it.
What's still unknown: whether the frozen $3 billion can actually be returned (analysts told CNBC that recovery usually requires court orders and can take months or years); how the engineer's laptop was compromised; whether US authorities will confirm the North Korea link; and how much of the unfrozen money will be laundered before it can be traced.
4 listed sources
References listed by US Brief; a source count is not a verification score.
Editorial sourcing notes
Sourcing: CNBC (Oct. 29–30, 2026), Binance's announcement and BBC live coverage. The North Korea attribution comes from private blockchain-analytics firms TRM Labs and Chainalysis; the FBI and US government had not publicly confirmed it in the reports reviewed. Dollar totals differ slightly by firm ($6.3 billion to $6.4 billion) and crypto prices move, so figures are approximate. Photos are file images (2023).
Like US Brief? You can support it with a tip.