North Korea's TraderTraitor group blamed for the record-breaking theft, raising urgent custody and suitability questions for advisors
Binance, the world's largest cryptocurrency exchange, confirmed on October 30, 2026 that approximately $6.3 billion in digital assets was drained from its wallets overnight, marking the single largest crypto theft on record - roughly four times the $1.5 billion Bybit hack of February 2025.
Blockchain intelligence firm TRM Labs, which attributed the attack to North Korea's elite hacking unit TraderTraitor with high confidence, said the funds were taken across ten blockchains in a coordinated sweep that began at approximately 20:05 UTC on October 29.
TraderTraitor, was identified by the FBI as responsible for the Bybit hack in February 2025. The North Korea-linked unit is considered the most prolific state-sponsored crypto theft operation in the world.
Binance said in statements on its X account that its initial investigation points to a compromised DevOps engineer's laptop, which allowed an attacker to access a service container and submit unauthorized withdrawal transactions. The company said it found no evidence of a private key leak and has engaged law enforcement and blockchain intelligence partners.
"User funds are safe," Binance stated, adding that all losses would be covered from its Secure Asset Fund for Users (SAFU) - a reserve established to protect customers against incidents of this kind - as well as from company funds. However, Johnny Mehta, Chief Investment Officer at Axis Investment Management, told CNBC that the SAFU fund may not be large enough to cover the losses.
Deposits and withdrawals were suspended across several networks as a precaution. Binance has approximately 335 million registered users globally and had about $162.8 billion in assets under custody as of its 2025 annual report.
How the attack unfolded
TRM Labs said preparation began at least 36 hours before the theft. The attacker's operator wallet received three small withdrawals from Tornado Cash - a service that obscures the origin of crypto funds - starting the morning of October 28, 2026.
On October 29, the attacker deployed code, ran tests on Binance wallets, and four hours after a final rehearsal, installed the same code on a Binance hot wallet.
TRM Labs said the theft itself took place in minutes and said that the attacker gained the ability to make Binance's hot wallet signing system produce valid signatures across chains.
Billions frozen, billions still at large
A rapid response from stablecoin issuers and blockchain networks contained part of the damage. Tether, Circle, Ripple, and World Liberty Financial collectively froze approximately $2.67 billion in stablecoins. Arbitrum's Security Council used emergency powers to freeze an additional 8,426 ETH and 74.6 million ARB tokens. Binance confirmed a verified frozen total of approximately $3 billion.
The attacker, however, moved quickly to convert freezable stablecoins into assets beyond any issuer's reach. About 325 million USDT was sold through decentralized trading protocols in exchange for approximately 122,300 ETH at a steep discount of more than 10%. As of October 30, 2026, the attacker holds more than 420,000 ETH and 18,270 BTC - worth approximately $2.4 billion - in assets that no issuer can freeze.
However, Bernardo Brites, CEO of Trace Finance, a stablecoin infrastructure company told Reuters that: "The more time passes, the less likely they will be able to fold those funds into other exchanges or payment providers - they essentially get blacklisted.”
Binance said a detailed technical post-mortem will be published once the investigation is complete and facts are fully verified. The investigation remains ongoing.
