Binance Hack: Record $6.3bn Crypto Theft Linked to North Korea

The world’s largest cryptocurrency exchange is trying to recover billions of dollars after what blockchain analysts call the biggest crypto theft on record. Binance says attackers took roughly $6.3 billion in digital assets late on Thursday, October 29, and three separate investigation firms have pointed to a North Korean state-backed hacking unit as the most likely culprit.

As of Saturday, October 31 (PKT), a large share of the money has been frozen, but the recovery figures quoted by the company have changed as its investigation has moved on, and part of the haul is still unaccounted for.

How the attackers got in

Binance’s first explanation was narrow. The company said the breach appeared to begin with a compromised laptop used by one of its engineers, which gave the intruder access to a service container and allowed unauthorised withdrawals to be submitted. It added that it had seen no sign that its private keys had leaked.

That account soon grew. Co-chief executive Richard Teng said later that “our subsequent investigation has uncovered additional points of breach” and that the operation “was not carried out by one person”. He also said the attackers used a self-destruct mechanism that wiped their tools as they went, making the trail harder to follow.

TRM Labs, a blockchain intelligence company, estimates that most of the theft was carried out in about 20 minutes.

Why North Korea is the main suspect

TRM Labs, Chainalysis and Elliptic have all linked the attack to TraderTraitor, a North Korean group that the security industry also connects with the wider Lazarus Group. TRM and Chainalysis said they reached that view with “high confidence”. Elliptic reported that some of the stolen funds landed in a wallet used earlier this year in a $351 million theft from the Bitget exchange.

These are assessments by private firms, not a formal government finding. Pyongyang has consistently rejected accusations of crypto theft, and Reuters received no reply when it sought comment from North Korea’s diplomatic mission in Geneva. The US Secret Service has said it is working to trace, freeze and recover the funds, and Binance says it is cooperating with the FBI.

The previous record was the theft of about $1.5 billion from the Bybit exchange in 2025, which the FBI attributed to North Korea. Elliptic estimates that Pyongyang has stolen more than $6.5 billion in crypto in recent years, including more than $1 billion so far in 2026.

How much has been recovered

The numbers depend on who is counting and when. A Binance spokesperson told TechCrunch on Friday that industry partners had frozen about $3 billion. The BBC later reported a company spokesperson saying around 80% of the stolen assets had been secured. Neither figure has been independently confirmed.

Stablecoin issuers have been able to act directly because they control their own tokens. Tether said it had frozen nearly $1.57 billion linked to the Binance theft and Circle said it had frozen $800 million, according to Reuters. Bitcoin and ether work differently: no single company controls them, so they cannot be frozen in the same way once they leave an exchange.

Binance says it has set aside about $6.34 billion of its own funds to cover customer losses. “Your money is safe, and we’re covering every loss,” Teng told users. The exchange suspended deposits and withdrawals after the attack, later said deposits were unaffected, and has promised to publish an updated proof of reserves once its clean-up is finished.

Markets and the wider industry

The news unsettled crypto markets. Bitcoin fell about 5% and was trading near $76,800 on Friday afternoon in New York, according to the BBC. Shares in Coinbase dropped 12%, although that slide also reflected quarterly revenue that came in slightly below forecasts.

Rival platforms moved quickly to reassure customers. Coinbase said it had adjusted the offline systems that hold its keys “solely out of an abundance of caution”, and Kraken said it was studying the incident for lessons. OKX chief executive Star Xu called for an industry-wide, real-time alert system so that exchanges can share information and freeze suspected stolen funds faster.

Not everyone is convinced by Binance’s assurances. Lawyers have warned customers not to treat the pledge to cover losses as legally binding; Daniel Tunkel of the London firm Edwin Coe told the BBC it would depend on what customers had been promised in their contracts.

What it means for ordinary users

Binance listed 335 million registered users in its 2025 annual report, according to the Guardian. For anyone holding assets on a large exchange, in Pakistan or elsewhere, the episode is a reminder that a platform’s size does not remove the risk of a security failure. Updates on balances and withdrawals should be taken only from the exchange’s verified channels, since major hacks are often followed by scams offering fake “recovery” help.

What happens next

Investigators will keep following the stolen funds across blockchains, and the final loss may rise or fall from the current estimate. Binance also faces pointed questions about how a single employee device could open a path to systems handling billions of dollars. Its promised proof-of-reserves report will be the first real test of whether its reassurances hold.

Related on Global News 47: More technology news