Irishexaminer Binance Hit by $6.3 Billion Cyberattack Linked to North Korea
Article Content
- •Binance lost approximately $6.3 billion in a cyberattack attributed to North Korea.
- •The attack involved unauthorized withdrawals from wallets across multiple blockchains.
- •Binance resumed withdrawals and covered 95% of the stolen assets using company funds.
On October 29, 2026, Binance suffered a significant cyberattack resulting in the theft of approximately $6.3 billion in various cryptocurrencies, including $296 million in XRP. The FBI attributed the attack to North Korea's TraderTraitor unit, marking it as potentially the largest financial theft in history. The breach involved unauthorized withdrawals from Binance-controlled wallets across multiple blockchains, with the first theft occurring on the XRP Ledger. Binance has since resumed withdrawals for several cryptocurrencies and reported that it covered 95% of the stolen assets using company funds. The exchange is working with law enforcement to recover the remaining stolen tokens and has frozen some affected assets. Analysts noted that the attack bore similarities to previous North Korean cyber operations. The incident has raised concerns about the security of cryptocurrency exchanges and the ongoing threat of state-sponsored cybercrime.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track Arkham in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What cryptocurrencies were affected?
How did Binance respond to the attack?
Is there a connection to North Korea?
Continue Reading
China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25… 
Chinese Actor Compromises US Government Networks via PHP2Shell Exploit A suspected Chinese nation-state actor exploited vulnerabilities in Palo Alto Networks firewalls using a chained PHP2Shell exploit and a Linux kernel privilege escalation flaw. The attack, which began on October 23, targeted 25 servers across the US, Japan, Taiwan, and South Korea, with a focus on US…