Binance has confirmed a security breach that resulted in the theft of roughly $6.3 billion from its wallets — an amount that, if estimates hold, would make it the largest hack in cryptocurrency history. Several blockchain investigators, including Chainalysis, say they have high confidence that North Korea was behind the attack.

CNN reported early Friday that hackers had stolen more than $6 billion from the exchange, with multiple investigators pointing to North Korea and Chainalysis expressing high confidence in that attribution.

The outflows were first spotted on Thursday evening, when about $2.8 billion was reported leaving Binance wallets. Founder Changpeng Zhao later said it looked like a hack. Since then, the picture has changed substantially.

What Binance Has Confirmed

In an update on its official X account, Binance moved from "investigating reports" to a confirmed incident. According to the exchange, a compromised engineer's laptop enabled unauthorized withdrawals. The attacker did not need the wallets' private keys, because access to the internal withdrawal system was enough to push transfers out. That distinction matters: access to the right internal system functioned as effectively as holding the keys, so the failure was in internal access controls rather than key custody.

Binance said it is working with law enforcement and blockchain intelligence firms to trace and recover the funds, and told users to rely only on its official channels.

How the Attack Unfolded

Blockchain intelligence firm TRM Labs said about $6.36 billion was moved from Binance wallets across 10 blockchains on Thursday, most of it within about 20 minutes starting at 4:05 p.m. US Eastern time, or 20:05 UTC. According to CNBC, TRM said the attack showed preparation well before the theft, including transaction signatures obtained in advance.

Why Investigators Point to North Korea

TRM attributes the attack to TraderTraitor, a North Korean state-sponsored hacking group. The FBI named the same group as responsible for the $1.5 billion theft from Bybit in February 2025. Chainalysis chief executive Jonathan Levin also said the firm assessed TraderTraitor as the likely culprit, citing links to earlier attacks. North Korea has previously denied hacking crypto exchanges, as Axios noted.

The method points in the same direction. Two days before the theft, on October 27, Binance said it had blocked a week of North Korea-linked attacks from a campaign known as Contagious Interview, which uses fake job interviews to trick developers into running malicious code on their machines. Binance has not said whether the compromised engineer's laptop is connected to that campaign.

If the estimates hold, the theft is more than four times the size of the previous record:

• Binance, October 2026 — about $6.3B
• Bybit, February 2025 — about $1.5B
• Ronin Network, March 2022 — about $620M

The top two entries share an alleged author: the FBI credits TraderTraitor with the Bybit theft, and TRM assigns the Binance breach to the same group.

Where the Money Is Now

About half of the stolen funds are frozen, mostly stablecoins whose issuers can block their own tokens. The rest is harder to reach. CoinDesk reported that the hacker had split about $1.4 billion in bitcoin across 19 wallets, an asset no issuer can freeze. A Pangolin Intelligence analyst told CNN that "the cat and mouse game has barely begun," expecting North Korea to tap money-laundering networks to cash out.

That split defines the recovery problem: the frozen half is largely in issuer-blocked stablecoins, while the unfrozen remainder depends on the tracing work Binance says it is conducting with law enforcement and blockchain intelligence firms.

Binance says users will not bear the losses, and its next disclosures will be the updated Proof of Reserves and the post-mortem. Whether the compromised laptop is tied to the Contagious Interview campaign, how quickly Binance reopens withdrawals, and how much of the unfrozen $3 billion investigators recover are the open questions.

This is a developing story. Last updated: October 30, 2026.