Skip to content
North Korean Hackers Steal $6.3 Billion from Binance in Record Cyber Heist

North Korean Hackers Steal $6.3 Billion from Binance in Record Cyber Heist

First seen 1 Nov 2026, 09:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 2, 2026 at 09:46 UTC
  • •Binance lost $6.3 billion in a cyberattack attributed to North Korean hackers.
  • •The FBI confirmed the involvement of the TraderTraitor hacking group in the breach.
  • •Binance has replenished 95% of stolen assets and resumed withdrawals in phases.

On October 29, 2026, Binance, the world's largest cryptocurrency exchange, suffered a massive cyberattack attributed to North Korean hackers known as TraderTraitor, resulting in the theft of approximately $6.3 billion in digital assets. The attackers exploited vulnerabilities in Binance's hot wallet system, allowing unauthorized withdrawals across multiple blockchains. The FBI confirmed the involvement of TraderTraitor, a group linked to previous high-profile hacks, including the $1.5 billion Bybit theft. Binance reported that it has replenished 95% of the stolen assets using its own funds, including its Secure Asset Fund for Users (SAFU). As of November 1, 2026, Binance began restoring withdrawals in phases, with a significant spike in customer withdrawals observed. Approximately $3 billion of the stolen assets have been frozen through cooperation with law enforcement and industry partners. The incident has raised concerns about the security of centralized exchanges and the ongoing threat of state-sponsored cybercrime.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 23h ago How this analysis works

Timeline

2026-05-14
Public exploit for CVE-2026-46300 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-10-13
CVE-2026-97229 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109619 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-109618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-29
Binance hack occurs
North Korean hackers exploit Binance's hot wallet, stealing $6.3 billion in digital assets in approximately 20 minutes.
Thenextweb
2026-10-30
FBI attributes hack to TraderTraitor
The FBI publicly attributes the Binance hack to North Korea's TraderTraitor group, confirming earlier suspicions.
Finance.Yahoo
2026-10-30
CVE-2026-112816 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-11-01
Binance resumes withdrawals
Binance begins phased restoration of withdrawals after covering 95% of the stolen assets.
Insurancejournal

More articles in this cluster (236)

Following this threat?

Track WannaCry, APT38 and TraderTraitor in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (44)

1 / 3

Common questions

What measures is Binance taking to secure user funds?
Binance has implemented enhanced security reviews and is working with law enforcement to trace and recover stolen assets.
How much of the stolen funds has Binance recovered?
Binance has replenished approximately 95% of the stolen assets using its own funds and SAFU.
Is the TraderTraitor group known for other attacks?
Yes, TraderTraitor has been linked to several high-profile cyberattacks, including the $1.5 billion Bybit hack.