On Thursday, October 29, 2026, attackers drained roughly $6.3 billion from Binance, the world’s largest cryptocurrency exchange. Reports put the figure between $6.3 billion and $6.4 billion depending on how assets were valued. It surpassed the $1.5 billion Bybit theft of February 2025, which was also pinned on North Korea, as the biggest crypto heist ever recorded.
How the attackers got in
Binance’s first statement said the intrusion began with a compromised engineer’s laptop, which gave the attacker access to a service container and let them submit unauthorized withdrawals. On November 3, the company gave more detail to reporters, as covered by Fortune.
Fake recruiters
According to Binance’s report, one engineer was contacted through a job-hunting platform by someone posing as a project director. That led to a first-round interview with a purported HR representative and a second with a person claiming to be the CEO of a fictitious company. The engineer was persuaded to download an “assignment” that gave the attackers a way in.
A tampered software download
The scheme also involved an advertising campaign that steered a second engineer to a tampered version of Homebrew, a popular software package manager. Binance said it detected and removed the fake download, but not before the attackers learned who managed its wallets.
Internal AI tools and a stray token
Binance said that after taking over the first engineer’s computer, the attacker used an internal AI tool to gain control over two other employees, a wallet DevOps engineer and a wallet software engineer. The DevOps engineer’s computer held a container deployment permission token, which proved critical. Fortune noted that the attack relied mainly on conventional phishing rather than novel AI techniques. Binance also said an Ethereum feature called EIP-7702 played a significant role in the theft, according to one report.
Binance said it had detected and prevented 57 North Korea-related hacking attempts in 2026 before this one. It also said staff in non-public-facing roles are not permitted to keep LinkedIn profiles, and declined to say whether the engineer had broken that policy.
Who is blamed, and on what evidence
Several blockchain intelligence firms pointed to North Korea within a day. TRM Labs attributed the theft to a group called TraderTraitor with high confidence, and Chainalysis told CNN it also had high confidence. Elliptic said some stolen funds landed in the same wallet used in an earlier attack on the Bitget exchange.
On October 31, the FBI, Secret Service and IRS Criminal Investigation jointly attributed the theft to North Korea’s TraderTraitor, the same label the FBI used for Bybit. The alert named the operation two days after the theft began, compared with five days for Bybit, according to one analysis. It listed 628 addresses, counted by that analysis as 608 on Ethereum, 19 on Bitcoin and 1 on Solana, and urged payment and exchange services to block transfers involving them. TraderTraitor is described as linked to the Lazarus Group, North Korea’s best-known hacking organization. North Korea denies involvement.
The money: frozen is not the same as recovered
Stablecoins like USDT and USDC can be frozen by their issuers at specific addresses. That is what happened here, and fast. Tether said it froze more than $1.5 billion in USDT within 30 minutes of the attack. Circle froze about $823 million in USDC and said it acted in coordination with law enforcement. Together that exceeds $2.37 billion, and Binance put the total frozen by all partners at about $3 billion.
| Item | Reported figure | Notes |
|---|---|---|
| Total stolen | ~$6.3B (some say $6.4B) | Binance, FBI and TechCrunch say 6.3 |
| Frozen by Tether | ~$1.57B USDT | CEO Paolo Ardoino’s figure |
| Frozen by Circle | ~$823M USDC | CEO Jeremy Allaire said it worked with law enforcement |
| All frozen, per Binance | ~$3B | Other tallies run $2.7B to $3B |
| “Recovered,” per Fortune | ~$2.5B | Another outlet said $2.85B; wording varies by source |
| Losses covered by Binance | 98% replenished | From reserves and other sources, as of Nov 3 |
Tether did not say whether the frozen funds would be returned to Binance or to users, and one outlet cautioned that frozen assets should not be treated as recovered. Binance said it set aside about $6.34 billion to cover losses, paused withdrawals for roughly 48 hours, and restored them over the weekend. It said customer funds were safe.
The rest of the stolen assets is spread across thousands of wallets as the attackers try to launder it, per Gujarat Samachar’s summary of the case. An analyst quoted by CNN expected North Korea to turn to laundering networks to cash out.
What U.S. agencies have actually done
The FBI said it was engaged with public and private partners. The Secret Service said its investigators were working around the clock with partners including Circle to identify, freeze, trace and recover the funds. Tether said it has onboarded the FBI and Secret Service to its investigations platform and, as of October 31, had helped freeze about 1.6 billion USDT across 3,590 wallets for the Justice Department, Secret Service and FBI. Separately, the chair of the CFTC, Michael Selig, cited the breach in support of a proposed registration framework for offshore exchanges.
A timeline of the first week
- October 29Attackers move funds out of Binance hot wallets across about 10 blockchains in roughly 20 minutes. Tether and Circle begin freezing addresses within hours.
- October 30Binance says user funds are safe and it will cover losses. The Secret Service confirms work with Circle, and Reuters reports Binance is working with the FBI.
- October 31The FBI, Secret Service and IRS-CI attribute the theft to TraderTraitor and publish 628 addresses.
- WeekendBinance reopens withdrawals after about 48 hours. Accounts differ on whether this began Saturday or Sunday.
- November 2Tether publicizes the $1.5B freeze.
- November 3Binance publishes its account of the LinkedIn and Homebrew campaign. About 98% of stolen coins are reported replenished.
Context: North Korea’s crypto thefts
This is not the first time Pyongyang-linked actors have hit a major platform, and past history shows how hard recovery is. Elliptic traced North Korean attacks on exchanges back to 2017, when four South Korean exchanges lost about $200 million in bitcoin. In 2022, hackers linked by the FBI to Lazarus and APT38 stole about $620 million from Axie Infinity’s Ronin network, and Binance helped recover only about $5.8 million of it. Bybit lost about $1.5 billion in February 2025, and DMM Bitcoin lost $305 million in 2024, with laundering later suspected to involve Lazarus. The Treasury said North Korea-linked hackers stole at least $2.8 billion between January 2024 and September 2025. Coverage of the new FBI alert also lists a Bitget theft of about $351 million to $387.5 million in 2026 and a $280 million Drift hack in April 2026 as North Korea-linked.
U.S. recoveries have been real but small compared with the totals. The Wall Street Journal reported that authorities seized more than $30 million taken from an online game by North Korea-linked hackers, which analysts called one of the largest recoveries of its kind. A Secret Service-led effort called Operation Atlantic, with the UK’s National Crime Agency, Binance and Coinbase, traced $45 million and froze $12 million tied to phishing scams.
What to watch for
Three developments would change the picture. First, forfeiture complaints or announcements that frozen funds are being seized and returned. Second, indictments naming individual operators, which for North Korean state hackers have usually been symbolic because the defendants are out of U.S. reach. Third, evidence of how much of the unfrozen balance is laundered successfully. As of today, none of these has been reported for the Binance case.