North Korean Hackers Blamed for $6.3 Billion Binance Crypto Theft
Hackers working for the North Korean regime have been blamed for stealing at least $6.3 billion in crypto from Binance wallets, according to TechCrunch, which reported the attribution on October 30, 2026.
TRM Labs, a U.S.-based blockchain analysis firm, attributed the breach to North Korean hackers and described it as the largest hack in history. Binance is the world's biggest cryptocurrency exchange, so the theft hit the largest custodial venue in the market, meaning a platform that holds customers' assets on their behalf. The breach is the largest known theft of crypto to date.
Binance said the attackers got into its network through a compromised engineer's laptop. From that endpoint, a developer machine, they reached a service container, a packaged internal application, which allowed them to submit unauthorized withdrawal transactions. Binance said it has seen no evidence that its private keys, the cryptographic credentials that authorize transfers, were leaked.
Security researchers said about half of the stolen $6.3 billion was frozen as the funds moved across multiple blockchains. The reporting attributes the activity to TraderTraitor, a North Korean hacker network that focuses almost exclusively on stealing crypto from large companies and exchanges.
Binance has suspended all deposits and withdrawals while its investigation continues. The exchange said user funds are safe and that it will publish an updated proof of reserves, a public accounting showing assets held against customer balances, once remediation is complete. That publication is a stated plan, and it has not yet been released.
In my view, the detail that matters most to operators is the route, not the headline figure. An employee's endpoint was able to reach a system capable of initiating withdrawals. Whatever the exact control failure turns out to be, the separation between developer workstations and the services that move customer assets is the layer that failed in this account. Binance's statement that it has seen no evidence of a private key leak points the post-incident work toward access control, identity for internal services, and network segmentation, rather than cold-storage key management alone.
The broader context here is the operating model of large exchanges. Hot wallets, which stay connected to the internet so funds can move at scale, mean every internal path to a withdrawal function becomes part of the attack surface. A theft of this size will likely prompt scrutiny of how exchanges authorize outbound transactions and how they monitor service-to-service calls for anomalous withdrawal patterns.
There is also a more constructive reading. Public blockchains leave a traceable record, and the fact that roughly half of the stolen funds was frozen during transit gives investigators and counterparties something concrete to act on. Whether that proportion holds as the investigation proceeds is an open question. For the industry, the practical lesson is that controls around withdrawal authorization now carry the weight that key custody once carried alone, and the next round of hardening will be judged on whether it closes the path an engineer's laptop was able to open.
