10 min read
The Binance hack North Korea is blamed for moved about $6.36 billion out of the exchange on October 29, 2026, and most of it went in about 20 minutes, according to TRM Labs. The FBI has named North Korea’s TraderTraitor hacking unit as responsible, Pyongyang calls that “absurd rhetoric”, and Binance says it will cover user losses itself. If you hold crypto anywhere, this case matters to you: it shows how state hackers break into an exchange, what happens to the money afterwards, and who pays when it goes missing.
Key takeaways
- About $6.36 billion left Binance wallets across ten blockchains on October 29, 2026, most of it within roughly 20 minutes (TRM Labs).
- The FBI says North Korea did it through the unit it calls TraderTraitor. North Korea denies it via its state news agency, KCNA.
- Binance says it is covering losses from its own funds, its futures insurance fund and part of SAFU, and that partners helped freeze roughly $3 billion.
- That is about four times the roughly $1.5 billion taken from Bybit in February 2025, a hack the FBI also attributed to North Korea.
What happened in the Binance hack, step by step
The attack was fast and wide. On October 29, 2026 an attacker moved about $6.36 billion out of Binance wallets on ten different blockchains, and TRM Labs says most of it left in about 20 minutes. NPR and CBS News round the figure to $6.3 billion. PBS NewsHour describes it as likely the biggest crypto theft ever.
Binance is one of the world’s largest cryptocurrency exchanges, a place where people buy, sell and store digital coins. The days after the theft moved quickly too.
| Date | What happened | Reported by |
|---|---|---|
| Oct 29, 2026 | About $6.36 billion moved out of Binance wallets across ten blockchains, most of it in about 20 minutes | TRM Labs, NPR, CBS |
| Oct 31, 2026 | Binance says backing is restored for 90% of affected assets and plans to resume withdrawals on Sunday | CNBC |
| Oct 31 to Nov 1, 2026 | FBI says North Korea, through TraderTraitor, was responsible | NBC News, PBS, Bloomberg |
| Nov 2, 2026 | Kim Yo Jong rejects the US claims as “absurd rhetoric”, via KCNA. Binance’s co-CEO says outflows have normalised | Reuters via US News, ABC News |
| Ongoing | Blockchain firms trace laundering of the funds, and withdrawals have resumed | Elliptic via Crypto Times, Gizmodo |
Why the FBI says North Korea was behind the Binance hack
The attribution comes in two layers, and they carry different weight. The first is official. The FBI said North Korea was responsible, acting through the hacking unit it calls TraderTraitor, according to NBC News, PBS and Bloomberg, which reported the statement between October 31 and November 1, 2026.
What is TraderTraitor, and how does it relate to Lazarus?
TraderTraitor is the FBI’s name for a North Korean state-linked group that targets cryptocurrency companies. Lazarus Group is the older, broader label security researchers have used for years for North Korean government hackers. Think of TraderTraitor as one crew operating under the bigger Lazarus umbrella.
What the blockchain detectives found
The second layer comes from private firms that follow money on public blockchains (the open ledgers that record every crypto transaction). TRM Labs, Chainalysis and Elliptic all link the hack to TraderTraitor and Lazarus, according to reporting by NPR, CNBC and CoinDesk. These firms match wallet patterns, laundering routes and techniques against earlier cases. Their findings are analysis, not a court ruling, and no criminal charges had been announced at the time of writing.
How did hackers get into Binance? What is known so far
Here the facts thin out, and you should treat every detail as provisional. NPR says many details remain unclear.
The leading technical theory, from TRM Labs, points to a compromise of Binance’s hot-wallet signing infrastructure. A hot wallet is the internet-connected wallet an exchange uses to process everyday withdrawals, and every transfer out needs a cryptographic signature. TRM says the attackers obtained signatures in advance and then executed them in one burst. That would explain the 20-minute speed: the hard work was done before anyone noticed.
Binance’s first explanation was a compromised employee laptop, and later reports described more points of compromise, according to NPR and TRM Labs. Fortune reported that North Korean operatives used LinkedIn and fake job interviews to trick a Binance engineer. That is a reported account, not a confirmed finding, but the method matches a long-documented pattern: a fake recruiter sends a “coding test” or a document that installs malware on the target’s machine.
North Korea denies the Binance hack: what KCNA said
Pyongyang rejects the accusation. Kim Yo Jong, the sister of leader Kim Jong Un and a senior official who often issues statements aimed at Washington and Seoul, called the US claims “absurd rhetoric and nothing new”. She said they showed Washington’s hostility, according to the state news agency KCNA, as reported by Reuters via US News and ABC News.
KCNA, the Korean Central News Agency, is the official mouthpiece of the North Korean government, so its statements are the government’s position, not independent reporting. North Korea has routinely denied involvement in cyber thefts attributed to it. What you have, then, is an FBI attribution backed by private blockchain analysis on one side and a flat state denial on the other.
Did Binance users lose money? How the losses are being covered
So far, Binance says customers will not carry the loss. The exchange said it would cover user losses itself, using corporate resources, part of its futures insurance fund and part of its Secure Asset Fund for Users (SAFU), according to CNBC. SAFU is an emergency reserve Binance set up years ago for exactly this kind of event.
How much has been restored or frozen?
In its October 31 update Binance said it had restored backing for 90% of the affected assets and planned to resume withdrawals on Sunday, CNBC reported. Binance also said it worked with blockchain partners to freeze roughly $3 billion of the affected assets, according to PBS NewsHour. Freezing usually means the issuer of a token, or another exchange that receives stolen funds, locks those coins so they cannot be moved or cashed out.
How much comes out of SAFU?
Reports disagree. One account says Binance is using half of SAFU’s bitcoin. Another says SAFU covers about a fifth of the loss. Until Binance publishes a full breakdown, treat both as unconfirmed.
On November 2, Binance’s co-CEO said outflows had normalised and that the company was in “very strong financial health”, according to Reuters via US News. Separately, Quartz reported that chief financial officer Kaiser Ng is leaving, with Justin Yek taking over the role.
How North Korea launders stolen crypto
Stealing billions is the easy half. Turning it into usable money without being caught is slower, and the blockchain firms are watching it happen in public.
Elliptic reported that the hackers laundered part of the funds through meme tokens on NEAR, a blockchain network, according to Crypto Times on November 10, 2026. Gizmodo reported laundering through memecoins too. Meme tokens are joke or hype coins with thin, chaotic trading. Swapping stolen funds into and out of them can blur the trail and turn traceable coins into something that looks like ordinary speculative trading.
The usual sequence in North Korea-linked cases runs like this:
- Split the haul across many wallets and blockchains, as happened here across ten chains.
- Swap tokens that an issuer can freeze into ones that are harder to freeze.
- Hop between blockchains using bridges and swap services.
- Cash out slowly through brokers and exchanges with weak identity checks.
Every one of those steps leaves a public record. That is why the frozen $3 billion matters: each frozen coin is one the attackers cannot spend.
Binance hack vs Bybit hack: how 2026 compares with 2025
Before this, the benchmark was Bybit. In February 2025 that exchange lost about $1.5 billion in a hack the FBI also attributed to North Korea, according to NBC News. The Binance theft is roughly four times larger.
| Point of comparison | Bybit (Feb 2025) | Binance (Oct 2026) |
|---|---|---|
| Amount taken | About $1.5 billion | About $6.36 billion (TRM Labs), or $6.3 billion (NPR, CBS) |
| FBI attribution | North Korea | North Korea, via TraderTraitor |
| Speed and spread | See NBC News coverage | Ten blockchains, most of it in about 20 minutes |
| Reported entry point | See NBC News coverage | Hot-wallet signing compromise (TRM Labs), employee laptop (Binance), fake job interviews (Fortune) |
| Who covers losses | See NBC News coverage | Binance: corporate funds, futures insurance fund, part of SAFU |
The pattern is the point. In both cases a top exchange was hit, the FBI named North Korea, and the money was spread out fast. Whether the attackers keep scaling up depends partly on how much of this haul stays frozen.
Why crypto theft matters to North Korea’s regime
North Korea lives under heavy international sanctions over its nuclear and missile programs, which cut it off from most normal trade and banking. US officials and United Nations sanctions monitors have long accused the country of using cyber theft to raise hard currency that sanctions would otherwise block. Crypto suits that goal: it moves across borders in minutes, needs no bank, and a few skilled operators can take more in an afternoon than many legal export lines earn in years.
That is why governments treat these thefts as a security problem and not only a crime against a company. If you want the wider context on how the North’s isolated economy differs from the South’s, see our guide to North Korea vs South Korea differences.
What the Binance hack means for crypto users and markets abroad
For ordinary users, the practical lesson is about where your coins sit. Coins held on an exchange depend on that exchange’s security and its ability to pay out after a loss. Binance says it can cover this one. Smaller platforms may have no reserve of that size at all.
Watch three practical signals:
- Withdrawals: Binance said it planned to resume them, and they have since restarted. Delays or limits would be a warning sign at any exchange.
- Disclosures: a clear public breakdown of how losses are funded, including the disputed SAFU share, builds more trust than reassuring statements.
- Security of the people: the reported fake job interview angle shows that employees, not just code, are the target.
For markets, the co-CEO’s statement that outflows have normalised suggests users did not stage a prolonged run, but prices of individual tokens depend on far more than one hack. This article explains events and is not investment advice.
FAQ
Did North Korea hack Binance?
The FBI says North Korea was responsible, acting through its TraderTraitor unit. Blockchain firms TRM Labs, Chainalysis and Elliptic also link the attack to North Korean hackers. North Korea denies it through KCNA, and no criminal charges had been announced at the time of writing.
How much was stolen in the Binance hack?
TRM Labs puts it at about $6.36 billion, moved across ten blockchains on October 29, 2026. NPR and CBS report it as $6.3 billion. Binance says partners helped freeze roughly $3 billion of the affected assets.
Did Binance customers lose their money?
Binance says it is covering user losses itself, using corporate funds, part of its futures insurance fund and part of SAFU. On October 31 it said backing was restored for 90% of affected assets. Check your own account only through the official Binance app or site.
What is TraderTraitor?
TraderTraitor is the FBI’s name for a North Korean state-linked hacking unit that targets cryptocurrency companies. It is commonly associated with the broader Lazarus Group, the label researchers use for North Korean government hackers.
How did the hackers get in?
The exact entry point is still unclear. TRM Labs points to a compromise of Binance’s hot-wallet signing system, Binance first cited a compromised employee laptop, and Fortune reported that operatives used LinkedIn and fake job interviews to trick an engineer.
Is the Binance hack bigger than the Bybit hack?
Yes. Bybit lost about $1.5 billion in February 2025 in a hack the FBI also attributed to North Korea. The Binance theft, at about $6.3 billion, is roughly four times that, and PBS calls it likely the biggest crypto theft ever.
What to watch next after the Binance hack
Three questions are still open. First, the exact entry point: a full Binance post-incident report would settle whether this started with a laptop, a fake job interview or several breaches at once. Second, the final recovery figure: watch how much of the frozen $3 billion stays frozen and whether more is clawed back as Elliptic, Chainalysis and TRM Labs keep tracing the laundering. Third, Washington’s response: whether the US Justice Department announces charges or the Treasury adds sanctions on the wallets and people involved. For updates, follow Binance’s official announcements page, the FBI’s public statements and the blockchain firms’ research blogs, and read any KCNA response for what it is: the North Korean government’s own claim.
Related reading
Sources trmlabs.com · npr.org · cbsnews.com · pbs.org · cnbc.com · k-korea.blog · usnews.com · qz.com
Prices, opening hours and availability change. Check the official page before you buy or travel.