North Korea-Linked Hackers Blamed for $6.3 Billion Binance Theft
Hackers working for the North Korean regime have been blamed for stealing at least $6.3 billion in crypto from Binance wallets, according to TechCrunch, which reported the attribution on October 30, 2026.
TRM Labs, a U.S.-based blockchain analysis firm, attributed the breach to North Korean hackers and described it as the largest hack in history. Binance is the world's biggest cryptocurrency exchange, so the theft lands on the largest custodial venue in the market. The breach is the largest known theft of crypto to date.
Binance said the attackers got into its network through a compromised engineer's laptop. From that endpoint they reached a service container, which allowed them to submit unauthorized withdrawal transactions. Binance said it has seen no evidence that its private keys were leaked.
Security researchers said about half of the stolen $6.3 billion was frozen as the funds moved across multiple blockchains. The reporting attributes the activity to TraderTraitor, a North Korean hacker network that focuses almost exclusively on stealing crypto from large companies and exchanges.
Binance has suspended all deposits and withdrawals while its investigation continues. The exchange said user funds are safe and that it will publish an updated proof of reserves once remediation is complete. That publication is a stated plan, and it has not yet been released.
In my view, the detail that matters most to operators is the route, not the headline figure. An endpoint belonging to an employee was able to reach a system capable of initiating withdrawals. Whatever the exact control failure turns out to be, the separation between developer workstations and the services that move customer assets is the layer that failed in this account. Binance's statement that it has seen no evidence of a private key leak points the post-incident work toward access control, identity for internal services, and network segmentation, rather than cold-storage key management alone.
The broader context here is the operating model of large exchanges. Hot wallets must stay connected to move funds at scale, and that connectivity means every internal path to a withdrawal function becomes part of the attack surface. A theft at this size will likely prompt scrutiny of how exchanges authorize outbound transactions and how they monitor service-to-service calls for anomalous withdrawal patterns.
There is also a more constructive reading. Public blockchains leave a traceable record, and the fact that roughly half of the stolen funds was frozen during transit gives investigators and counterparties something concrete to act on. Whether that proportion holds as the investigation proceeds is an open question. For the industry, the practical lesson is that the controls around withdrawal authorization now carry the weight that key custody once did on its own, and that the next round of hardening will be judged on whether it closes the path an engineer's laptop was able to open.
