Binance experienced a significant security breach on October 29, 2026, resulting in the theft of approximately $6.3 billion in token assets from its exchange. Blockchain analysis firm TRM Labs reported that the stolen assets left Binance wallets across ten different blockchains. While Binance confirmed the scale of the loss, the company stated that affected users would be fully compensated through its SAFU fund and corporate reserves.
Attribution and attack method
The FBI attributed the theft to North Korea and specifically identified the hacking group known as TraderTraitor as the responsible party. North Korean authorities rejected these claims, with Kim Yo Jong dismissing the attribution as baseless provocation.
Investigators reported that the hackers gained access to Binance’s systems through a multi-stage attack. An employee’s work computer was targeted with malware delivered via a fake recruitment scheme. The attackers then leveraged a compromised internal AI tool to ultimately access the wallet-signing service, allowing them to transfer the assets. Available reports did not indicate that the underlying blockchain infrastructure was compromised.
TRM Labs estimated that about $6.36 billion was withdrawn from Binance’s wallets following the breach. Of these assets, nearly $2.7 billion had been frozen by November 3, while approximately $2.4 billion remained under the attackers’ control in Ethereum and Bitcoin wallets.
TRM Labs explained that the incident involved “a sophisticated social engineering attack, followed by the exploitation of internal tools to access the wallet-signing service.” The firm noted that stablecoin issuers jointly froze around $2.67 billion in response to the hack, an action described as unprecedented within the digital asset industry.
Industry and official response
The FBI urged digital asset and blockchain service providers to block any transactions linked to the addresses associated with the accused hacking group. Meanwhile, major industry players including Tether coordinated with authorities and froze suspicious assets quickly after the theft was detected.
Ari Redbord, policy chief at TRM Labs, described the incident as “cyber war” and called for governments to take proactive measures against state-backed hacking groups. He estimated that North Korea’s total value of stolen crypto since 2017 amounts to roughly $12.5 billion, with this single Binance theft representing approximately one-third of the country’s gross domestic product.
Asset prices showed mixed responses following the hack. As of November 7 at 11:13 UTC, Bitcoin was trading at $75,917, a slight decline of 0.02% over the previous 24 hours. Ethereum saw a modest increase to $2,244.34, up 0.53%, while BNB remained steady at $694.25. The Crypto Fear & Greed Index stood at 25, signaling extreme fear among market participants according to Alternative.me.
In fast-moving situations like this, where attackers are shifting funds through different blockchains such as TRON and Solana, staying updated is crucial. Investors and analysts looking to monitor the movement of the remaining funds and the broader impact on digital asset prices can leverage CryptoAppsy’s real-time charting and live news features to track activity across multiple blockchains and capture critical market changes as they happen.
Continued investigation and what’s next
Key questions for investigators include whether additional stolen funds can be traced or recovered and whether further evidence will solidify or challenge the FBI’s attribution of responsibility. As of November 3, the main Ethereum and Bitcoin balances controlled by the attacker showed no new notable activity, but TRM Labs reported ongoing transactions occurring on networks like TRON and Solana.
The breach is prompting crypto exchanges and service providers to revisit their security protocols, particularly regarding employee-device controls, screening for social engineering attempts, and the protection of internal AI tools and signing systems. However, there has been no official confirmation of specific new measures or reforms at Binance or related firms since the incident was made public.
Redbord emphasized the need for coordinated action between the private sector and governments, suggesting that the scale of this exploit demonstrates the rising stakes and global complexity of digital asset security.
