President Donald Trump said he will review the Binance hack after North Korea-linked hackers allegedly drained the exchange’s hot wallets in roughly 20 minutes. The incident is being described as the largest cryptocurrency theft on record and has drawn the White House directly into the response.

An estimated $6.3 billion in digital assets was taken from Binance hot wallets on October 29, 2026. The breach began at approximately 20:05 UTC and continued for about 20 minutes, affecting hot wallets across multiple blockchains. Hot wallets are the internet-connected wallets exchanges use to process day-to-day withdrawals, distinguishing them from offline cold storage.

Attack attributed to TraderTraitor

The attack has been attributed to TraderTraitor, a North Korean hacking group known to be linked with the Lazarus Group. TraderTraitor is also the name U.S. government agencies have used in joint advisories describing North Korean cyber campaigns targeting cryptocurrency platforms. Lazarus has been associated with some of the most prominent cryptocurrency heists in the industry’s history, a record that has made North Korea-linked theft a recurring policy concern.

The investigation indicated that a compromised laptop belonging to a DevOps engineer enabled unauthorized access to company assets.

The reported loss is more than four times larger than the previous record, the $1.5 billion Bybit hack in 2025.

Binance outlines response

Binance halted all withdrawals after identifying the breach. The exchange said it would use its Secure Asset Fund for Users, or SAFU, together with its corporate treasury to cover the losses. SAFU is an emergency fund established by Binance for incidents of this nature.

The total amount allocated to the response exceeds $6.34 billion, slightly more than the estimated amount stolen.

Issuers and other partners have frozen approximately $3 billion in assets, most of them stablecoins. Stablecoin issuers can freeze balances directly at the token level, a capability that has made issuer cooperation central to containing large-scale thefts. World Liberty Financial has also been linked to efforts to freeze funds associated with the attack.

Binance co-CEOs Yi He and Richard Teng are directly involved in managing the response. Founder Changpeng Zhao has publicly assured users that their funds are safe.

The exchange is targeting a resumption of withdrawals within 45 hours and said it is working with law enforcement agencies to meet that timetable, a deadline that will serve as the most immediate marker of how the recovery is progressing.

Why the White House is monitoring the incident

Trump said he would review the matter because of its broad implications. The alleged involvement of a North Korean state-linked group helps explain the White House’s interest: the theft of billions of dollars from a major cryptocurrency exchange raises both consumer-protection and national-security concerns. How the review develops, alongside the pace of the freeze efforts already underway, will be among the immediate items to watch as the situation evolves.

Cryptocurrency prices fell after news of the hack emerged.

This article was edited by John Chen. CryptoBriefing’s Editorial Policy provides information about how its content is created and reviewed.

Source: CryptoBriefing.