Update, Nov. 4: Binance said Tuesday that the theft grew out of a months-long campaign that began with a fake job interview and a booby-trapped coding assignment for one of its engineers, after which the attacker used a compromised internal AI tool to reach more engineers' machines, The Primary Wire reported.
Update, Nov. 1: The FBI Saturday attributed the theft to North Korea's TraderTraitor hacking unit, the first U.S. government attribution, and Binance began reopening withdrawals in phases Sunday, The Primary Wire reported.
Update, Oct. 31: Binance said Saturday it has covered up to 90% of the roughly $6.3 billion in stolen tokens from its user-protection fund, part of its futures insurance fund and its company treasury, CNBC reported. The money replaces customer balances; it is not recovered from the attacker. The remaining 10% is in less liquid tokens that may take longer to buy, and Binance says it remains on track to reopen withdrawals Sunday, subject to security checks. The FBI told Nextgov/FCW it is "aware of the incident" and working with public and private partners, but it did not attribute the theft to North Korea.
Binance, the world's largest cryptocurrency exchange, said hackers took about $6.3 billion from its wallets Thursday in what blockchain analysts call the largest crypto theft on record, The Associated Press reported Friday. Two blockchain-analysis firms tied the attack to a North Korean state hacking unit, and Binance said the intrusion started with one engineer's compromised laptop, showing how one developer machine can open a path to a company's most valuable systems.
What Happened
The outflows began Thursday afternoon U.S. Eastern time and hit wallets on 10 blockchains, mostly within about 20 minutes, according to TRM Labs, a U.S. blockchain intelligence firm. TRM puts the total at about $6.36 billion, roughly four times the $1.5 billion taken from the exchange Bybit in February 2025.
Binance said its initial investigation pointed to a compromised laptop belonging to a DevOps engineer, whose access let the attacker reach a service container, an isolated software environment, and submit unauthorized withdrawals, as reported by BleepingComputer. Binance later said it had found additional "points of breach," and co-CEO Richard Teng said "the attacker did not simply use one engineer's permissions" and that no individual has been blamed. The exchange said it found "no evidence of any wallet private key leak."
TRM assesses that the attacker most likely gained control of Binance's hot-wallet signing system, the internet-connected machinery that approves withdrawals. It said staging began at least 36 hours earlier, including attack code rehearsed on test wallets. Binance has not published a root cause.
Binance says partners froze about $3 billion. TRM counts about $2.7 billion, including roughly 1.77 billion USDT frozen by Tether and about 825 million USDC frozen by Circle, issuers of those dollar-pegged tokens. TRM says the attacker still controls more than 420,000 ether and 18,270 bitcoin, about $2.4 billion that no issuer can freeze. Binance halted withdrawals, said it expects them to resume within a day or two and pledged to cover all losses from its user-protection fund and company money.
Who Is Blamed
TRM attributed the theft "with high confidence" to TraderTraitor, which it calls North Korea's elite hacking unit, citing similarities to the Bybit theft and the April 2026 KelpDAO hack. Chainalysis chief executive Jonathan Levin wrote on X that the group was the likely culprit, and Chainalysis said Binance proceeds had mixed with funds stolen from the exchange Bitget, whose break-in The Primary Wire reported in September.
Binance has not named an attacker; a spokesperson said only that it is working with law enforcement. Neither the AP nor The Record initially reported any U.S. government statement on the case. The FBI attributed the Bybit theft to TraderTraitor.
Why It Matters
If the attribution holds, the haul would go to a heavily sanctioned government. U.S. officials say North Korea's crypto theft funds its weapons programs, The Record noted, and United Nations investigators estimated the country took in $3 billion from such attacks between 2017 and 2023.
For exchanges, fintechs, payment firms and custodians, the lesson is the path in. Kok Tin Gan, chief executive of security firm NyxLab, asked in the AP report why stronger approval controls were not in place, saying a single signature appears to have granted a never-expiring, full-access token to a hot wallet. Boards can ask whether any engineer's laptop can reach systems that move money, whether signing approvals expire and need more than one person, and how quickly abnormal outflows trigger an automatic stop.
What to Watch
Binance says it will release technical details after its investigation and publish an updated proof of reserves, an accounting of the customer assets it holds, once remediation is complete. Watch for any FBI or Treasury Department attribution or sanctions, whether the unfrozen $2.4 billion moves through cross-chain bridges and over-the-counter brokers as TRM expects, and whether withdrawals reopen Sunday as planned.
