News · October 30, 2026, 18:31 UTC
Binance, the world’s largest cryptocurrency exchange, said hackers accessed about $6.3 billion in digital assets in what blockchain analysts describe as the biggest known crypto theft, and the company said it has frozen roughly half of the stolen funds.
The breach was disclosed on Friday, October 30, 2026, and multiple crypto-tracing firms have linked it to a North Korean hacking unit.
Crypto stocks tumbled on Friday following the disclosure, Business Insider reported. The US Secret Service said it was working with partners to trace and recover the funds, while Binance said it was cooperating with the FBI.
What happened
Binance initially said the breach may have started with a compromised DevOps engineer’s laptop, which the company said allowed an attacker to reach a service container and submit unauthorized withdrawal transactions.
In later statements, Binance said its investigation had uncovered additional points of entry, indicating a broader attack.
Co-CEO Richard Teng said in a video posted to X on Friday that the attacker used a “self-destruct mechanism” that destroyed tooling and traces as the hackers moved, complicating the investigation. He said the operation was not carried out by one person.
Binance said it is working with law enforcement and would publish a detailed technical postmortem once the investigation is complete.
Blockchain intelligence firm TRM Labs said several elements of the attack resembled earlier North Korea-linked incidents and attributed the heist to a group known as TraderTraitor, also called the Lazarus group, with high confidence.
Chainalysis said it also had a high degree of confidence in the North Korean attribution, citing stolen Binance funds “commingling” with funds taken in an earlier exchange hack last month.
Binance has not publicly confirmed the attackers’ identities, and North Korea has previously denied hacking allegations.
Binance said it would cover all losses from company funds and an emergency assets fund and that user deposits were unaffected. The exchange temporarily suspended deposits and withdrawals while security checks were completed and said it expected withdrawal services to resume by Sunday morning.
The US Secret Service, the lead federal agency for financial crimes, said it was “working around the clock” with private-sector partners to identify, freeze, trace and recover the stolen funds, and said it would work to identify those responsible.
Binance said its US-facing exchange was unaffected, though the hack involved some US-linked assets, including stablecoins issued by Tether and Circle.
Analysis: Why it matters for investors
If the reported attribution holds, the episode would reinforce a pattern that analysts have flagged for years: exchange security is as much a geopolitical risk as an operational one.
Chainalysis said TraderTraitor has repeatedly targeted crypto exchanges to raise funds for the North Korean regime, and TRM Labs noted that very few actors could coordinate an attack across 11 blockchains in about three hours, according to Elliptic’s Tom Robinson.
The immediate market reaction was negative for listed crypto-related equities, Business Insider reported. How durable that pressure proves will likely depend on whether Binance restores withdrawals on schedule and whether the frozen share of the funds rises further.
The company has said customer funds are safe and losses will be covered, but experts quoted by the BBC cautioned that such promises may not be legally binding and that customers could need to pursue litigation.
For investors in the sector, the case may sharpen scrutiny of custody arrangements, insurance-like backstops and disclosure practices at large venues.
It may also add weight to arguments that tracing and freezing cooperation among rival platforms has become a core part of the industry’s risk defenses. These are conditional observations, not forecasts; the sources do not quantify the financial impact on Binance’s balance sheet.
Who is affected
Binance customers are the most directly exposed. The exchange said deposits remain unaffected and that it is covering every loss, and it expects withdrawals to resume by Sunday morning. Some users may face delays in accessing funds until then.
Publicly traded crypto companies saw share prices fall on Friday, according to Business Insider, though the outlets did not provide specific percentage moves in the material reviewed.
Coinbase CEO Brian Armstrong said his company had reached out to Binance to offer assistance, including blocking sends to compromised wallets.
Law enforcement and regulators are also involved. The Secret Service said it was coordinating with the US Attorney’s Office for the District of Columbia and other law enforcement partners. Binance founder Changpeng Zhao said on X that “token recovery has already begun.”
What is still uncertain
The sources do not say how much of the stolen money remains unfrozen beyond the roughly $3 billion Binance says has been secured, nor have the attackers’ identities been confirmed by the company. Binance has not responded to the BBC’s queries about possible links to North Korea.
Whether Binance’s pledge to cover losses will fully satisfy customers, and on what legal basis, has not been disclosed. The full technical postmortem has not yet been published.
Conclusion: What to watch next
Three developments matter most. First, whether Binance restores withdrawals by Sunday morning as expected. Second, whether investigators and exchange partners can freeze a larger share of the roughly $6.3 billion, with Chainalysis saying about $3 billion had already been frozen.
Third, whether formal attribution follows from US authorities; the FBI has blamed North Korea for similar hacks in the past, but no confirmed public attribution for this breach was included in the material reviewed.
Brokertable.net has not reviewed the original Binance statements or law enforcement documents; details here rest on reporting by Business Insider, BBC News, CNN, and Yahoo Finance.
Frequently Asked Questions
How much was stolen in the Binance hack?
About $6.3 billion in cryptocurrency was accessed, according to BBC News and CNN. Binance said it froze roughly $3 billion of the stolen assets.
Who is suspected of carrying out the attack?
TRM Labs and Chainalysis said they have high confidence that a North Korean group known as TraderTraitor, also called the Lazarus group, was responsible. Binance has not publicly confirmed the attackers' identities.
Did Binance customers lose money?
Binance said user deposits were unaffected and that it would cover all losses from company funds and an emergency assets fund. Withdrawals were temporarily suspended, with service expected to resume by Sunday morning.
What are US authorities doing?
The US Secret Service said it is working around the clock with partners to identify, freeze, trace and recover the stolen funds. Binance also said it is working with the FBI.
How did the hackers get in?
Binance initially pointed to a compromised engineer's laptop, then said its investigation found additional points of entry. Co-CEO Richard Teng said the attackers used a self-destruct mechanism to destroy traces.
AI Notice: This article was created wholly or predominantly with the assistance of artificial intelligence and was published without human editorial review.
This article is for general information only and does not constitute investment advice. Always do your own research before making trading decisions.