Binance Suffers $6.3 Billion Hack Linked to North Korean Group
Article Content
- •Binance was hacked for $6.3 billion, the largest theft in cryptocurrency history.
- •The FBI linked the attack to North Korea's TraderTraitor hacking group.
- •Binance has begun phased withdrawals, covering 90% of stolen assets with its own funds.
On October 29, 2026, Binance, the world's largest cryptocurrency exchange, was hacked, resulting in the theft of approximately $6.3 billion in digital assets. The FBI attributed the attack to the North Korean hacking group known as TraderTraitor. The breach involved unauthorized withdrawals from Binance's hot wallets, which hold funds for immediate transactions. In response, Binance temporarily suspended all withdrawals and initiated a recovery process, utilizing over $6.34 billion from its corporate reserves to cover 90% of the stolen assets. As of November 1, 2026, Binance has begun resuming withdrawals in phases, prioritizing assets based on user demand. Approximately $3 billion of the stolen assets have been frozen through collaboration with law enforcement and other exchanges. The remaining 10% of the stolen funds consists of less liquid tokens that may take longer to source. The incident has raised significant concerns about the security of cryptocurrency exchanges and the potential for further attacks.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (101)
Following this threat?
Track APT38, TraderTraitor and Binance in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What cryptocurrencies were affected?
How is Binance covering the losses?
What should users do now?
Continue Reading
Record $6.3 Billion Hack of Binance Attributed to North Korean Hackers On October 29, 2026, Binance, the world's largest cryptocurrency exchange, suffered a massive cyberattack resulting in the theft of approximately $6.3 billion in digital assets. The breach was reportedly executed through a compromised laptop belonging to a DevOps engineer, allowing attackers to gain unauthorized…
Poland Wiper Attacks Utilize Obfuscated Files and Deobfuscation Techniques In the 2025 Poland Wiper Attacks, adversaries employed obfuscated files to conceal malware artifacts, specifically using Base64-encoded ZIP archives to evade detection. The attacks affected various systems, leveraging techniques like encrypted payloads and user execution. Tools such as certutil were utilized for…