Binance, the world’s largest cryptocurrency exchange, is working to recover roughly $6.3 billion stolen in a major security breach that blockchain intelligence firms have attributed to North Korean hackers. The theft, which occurred on 29 October 2026, involved unauthorised withdrawals from Binance hot wallets across multiple blockchains, including Ethereum, Bitcoin, Tron and Solana. Most of the funds were moved within about 20 minutes, according to analysis by TRM Labs, which estimated the total at approximately $6.36 billion.

TRM Labs and Chainalysis both linked the attack with high confidence to TraderTraitor, a North Korean unit previously blamed by the FBI for the $1.5 billion Bybit hack in 2025. The firms cited similarities in methods and the mixing of stolen funds with proceeds from earlier incidents attributed to the same actors. Binance has not publicly named a culprit and is cooperating with the FBI and US Secret Service.

Binance’s initial findings pointed to a compromised DevOps engineer’s laptop that allowed access to a service container used for withdrawals. The exchange later reported additional points of breach. No evidence of private key leaks has been disclosed.

In response, Binance temporarily suspended withdrawals and deposits while conducting security checks. It has set aside more than $6.34 billion in company funds, including assets matching those stolen, and said it will cover all customer losses through its Secure Asset Fund for Users (SAFU) and other reserves. About $3 billion in stolen assets has been frozen so far by stablecoin issuers including Tether and Circle, as well as other network operators.

Cryptocurrency prices declined following news of the incident. Industry analysts describe the scale of the theft as unprecedented and larger than any previous crypto heist. Recovery efforts continue through blockchain tracing, freezes and coordination with law enforcement and industry partners. Withdrawals were expected to resume within days once security reviews were complete.