Hackers have reportedly stolen approximately $6.3bn worth of cryptocurrency from Binance, the world’s largest cryptocurrency exchange, in what cybersecurity investigators describe as the biggest cryptocurrency theft on record.
The unprecedented attack, which occurred on Thursday, October 29, 2026, targeted Binance wallets across multiple blockchain networks, with investigators pointing to a suspected connection with North Korea’s state-sponsored hacking operations.
According to blockchain intelligence firm TRM Labs, approximately $6.36bn in digital assets was transferred from Binance-controlled wallets across 10 different blockchains. Most of the transactions reportedly took place within approximately 20 minutes.
TRM Labs attributed the attack to TraderTraitor, an elite North Korean hacking unit believed to operate within the country’s wider cybercrime network.
The organisation said its assessment was based on extensive on-chain and off-chain intelligence, adding that the methods employed bore similarities to previous cryptocurrency thefts linked to North Korean hackers.
The suspected group has previously been associated with major cyberattacks, including the February 2025 Bybit cryptocurrency exchange breach, which resulted in the theft of approximately $1.5bn.
Preliminary investigations into the Binance incident indicate that attackers may have gained access through a compromised employee’s laptop, enabling them to manipulate the exchange’s transaction approval infrastructure and initiate unauthorised transfers.
The stolen assets reportedly included Bitcoin, Ethereum, USDT and other digital currencies spread across several blockchain networks.
Following the discovery, Binance temporarily suspended deposits and withdrawals on affected networks while launching an investigation and working with law enforcement agencies and cryptocurrency security partners.
The exchange also moved to reassure customers that their funds remained safe, promising to absorb the losses and ensure that affected users would not bear the financial consequences.
Blockchain investigators said cryptocurrency companies and financial institutions responded rapidly by freezing portions of the stolen assets.
TRM Labs estimated that approximately $2.7bn had been frozen by cryptocurrency issuers and blockchain security partners, including Tether, Circle and other industry participants. However, billions of dollars remained under the suspected attackers’ control.
The incident has renewed concerns about the growing sophistication of North Korean cybercrime operations and their increasing reliance on cryptocurrency theft to generate foreign currency.
International security experts have repeatedly accused North Korea of using cyberattacks against financial institutions and cryptocurrency platforms to circumvent international sanctions and generate revenue for its government.
The country’s hacking networks have also been linked to attempts to finance prohibited weapons programmes through illicit financial activities.
Meanwhile, the Binance incident is expected to intensify scrutiny of security arrangements across the global cryptocurrency industry, particularly the protection of digital wallets and transaction approval systems.
With investigators still tracing the stolen assets and attempting to identify those responsible, the attack represents a significant challenge to confidence in cryptocurrency exchanges.
Although the alleged North Korean connection has attracted international attention, Binance has yet to publicly establish the identity of the perpetrators.
The investigation remains ongoing as authorities and blockchain intelligence companies work to recover the stolen funds and prevent further movement of the assets.
