Binance and its founder, Changpeng Zhao, were targeted in a cryptocurrency heist that occurred on Thursday, Oct. 29, 2026. Blockchain intelligence firm TRM reported that approximately $6.3 billion in Bitcoin and other digital assets were stolen from customer accounts. The FBI and private investigators have attributed the attack to TraderTraitor, a hacking unit associated with North Korea.
This incident follows years of legal scrutiny for the cryptocurrency exchange, which was founded by Zhao in 2017. In November 2023, Binance pleaded guilty to federal charges including money laundering violations and failure to register as a money transmitting business. As part of that resolution, the company agreed to pay over $4 billion in penalties. Zhao also pleaded guilty to violating the Bank Secrecy Act and served four months in jail before being pardoned by President Donald Trump in October 2025.
Regarding the recent theft, Binance stated on Friday, Oct. 30, 2026, that it has begun recovering funds by working with partners to freeze approximately $3 billion in affected assets. Zhao posted on the social media platform X that user funds are safe. Investigators from TRM stated that North Korea likely targeted the exchange to acquire foreign currency and bypass United Nations sanctions related to its nuclear weapons program.
The $6.3 billion loss represents what investigators call the largest heist in the history of the industry. The impact is concentrated on individuals who hold digital wallets on the platform, which is currently the world's largest exchange by trade volume. While Binance reported it has frozen $3 billion, roughly half of the stolen funds remain unrecovered.
Users may notice a direct change in their ability to access or trade specific assets while the company continues its recovery efforts. Those with affected accounts may see frozen balances or delays in withdrawals as Binance coordinates with blockchain partners. The incident also highlights the security risks for participants in decentralized finance, where digital assets can be moved across borders by state-sponsored actors in minutes.
The attribution to North Korea suggests continued use of cyberattacks to fund government programs, which may lead to further regulatory pressure on exchanges to verify user identities. What happens next involves ongoing recovery efforts by Binance and potential updates from the FBI. No specific court dates or deadlines for the return of the remaining $3.3 billion have been reported.