Key Takeaways Compromised engineer laptop enabled unauthorized withdrawals. Binance estimates impact at about $6.3 billion. Around $3 billion frozen with blockchain partners. TRM, Chainalysis
CNN reported early Friday that hackers had stolen more than $6 billion from Binance, with several investigators pointing to North Korea and Chainalysis saying it had high confidence in that attribution.
The outflows were first spotted on Thursday evening, when about $2.8 billion was reported leaving Binance wallets, and Binance founder Changpeng Zhao later said it looked like a hack. Since then, the picture has changed substantially.
In an update on its official X account, Binance moved from “investigating reports” to a confirmed incident:
CauseA compromised DevOps engineer’s laptop gave the attacker access to a service container used to submit unauthorized withdrawals Private keysNo evidence of any wallet private key leak Estimated impactAbout $6.3 billion FrozenAbout $3 billion on-chain, with partners including Tether, Circle, Ripple, World Liberty and Paxos AccountsDeposits and withdrawals suspended; the affected address’s authorization revoked LossesTo be covered from the SAFU fund and company funds NextAn updated Proof of Reserves once remediation is complete, followed by a full technical post-mortemBinance said it is working with law enforcement and blockchain intelligence firms to trace and recover the funds, and told users to rely only on its official channels.
Blockchain intelligence firm TRM Labs said about $6.36 billion was moved from Binance wallets across 10 blockchains on Thursday, most of it within about 20 minutes starting at 4:05 p.m. US Eastern time, or 20:05 UTC. According to CNBC, TRM said the attack showed preparation well before the theft, including transaction signatures obtained in advance.
That fits Binance’s own account: the attacker did not need the wallets’ private keys, because access to the internal withdrawal system was enough to push transfers out.
TRM attributes the attack to TraderTraitor, a North Korean state-sponsored hacking group. The FBI named the same group as responsible for the $1.5 billion theft from Bybit in February 2025. Chainalysis chief executive Jonathan Levin also said the firm assessed TraderTraitor as the likely culprit, citing links to earlier attacks. North Korea has previously denied hacking crypto exchanges, Axios noted.
The method points in the same direction. Two days before the theft, on October 27, Binance said it had blocked a week of North Korea-linked attacks from a campaign known as Contagious Interview, which uses fake job interviews to trick developers into running malicious code on their machines. Binance has not said whether the compromised engineer’s laptop is connected to that campaign.
If the estimates hold, the theft is more than four times the size of the previous record:
Binance, October 2026 · about $6.3B
Bybit, February 2025 · about $1.5B
Ronin Network, March 2022 · about $620M
About half of the stolen funds are frozen, mostly stablecoins whose issuers can block their own tokens. The rest is harder to reach. CoinDesk reported that the hacker had split about $1.4 billion in bitcoin across 19 wallets, an asset no issuer can freeze. A Pangolin Intelligence analyst told CNN that “the cat and mouse game has barely begun,” expecting North Korea to tap money-laundering networks to cash out.
Binance says users will not bear the losses, and its next disclosures will be the updated Proof of Reserves and the post-mortem. How quickly it reopens withdrawals, and how much of the unfrozen $3 billion investigators recover, are the open questions.
This is a developing story. Last updated: October 30, 2026.
The post Binance Confirms Biggest-Ever $6.3B Hack, North Korea Blamed appeared first on Coindoo.
