Blockchain intelligence firms reported on Friday, October 30, 2026, that the cryptocurrency exchange Binance was targeted in a security breach involving approximately $6.36 billion. TRM Labs and Chainalysis attributed the incident to TraderTraitor, a hacking unit linked by U.S. and South Korean authorities to the North Korean government. Binance, the world’s largest cryptocurrency exchange, suspended withdrawals following the event but stated that deposits remained unaffected and all user losses would be covered.
The incident follows a history of cyberattacks attributed to North Korea by international law enforcement. In February 2025, the FBI identified North Korea and TraderTraitor as responsible for a $1.5 billion theft from the Bybit exchange. Additionally, South Korea's intelligence agency reported in December 2022 that North Korean hackers had stolen an estimated 1.5 trillion won ($1.1 billion) in virtual assets over the preceding five-year period, with more than half of that total occurring in 2022 alone.
TRM Labs reported that the attacker moved the funds out of Binance wallets across ten blockchains, with the majority of the activity occurring within a 20-minute window. Ari Redbord, global head of policy at TRM Labs, stated the firm made the attribution to North Korea with "high confidence" based on on-chain data and off-chain intelligence. Binance reported that it worked with partners, including stablecoin issuers Circle and Tether, to freeze roughly $3 billion—approximately 40%—of the affected assets. The company initially suggested a compromised laptop was involved but later identified additional "points of breach."
The $6.36 billion reported stolen represents the largest cryptocurrency theft on record, more than quadrupling the $1.5 billion Bybit hack from the previous year. For individual users, the immediate impact was a suspension of all withdrawals, preventing customers from accessing their funds for a period expected to last one to two days. While Binance has committed to covering all losses, the incident highlights a vulnerability where a single security breach can impact billions of dollars in digital assets in under half an hour.
Experts and intelligence agencies, including the South Korean spy agency, report that North Korea utilizes stolen cryptocurrency to fund its nuclear program and bypass United Nations sanctions. The use of artificial intelligence in such attacks, according to Redbord, allows hackers to operate at machine speed, potentially outpacing the compliance and security teams at major financial institutions. This puts pressure on regulators and exchanges to implement more stringent approval controls.
The next steps involve a joint investigation between Binance and law enforcement partners to confirm the identities of those involved. Binance has stated it will release a full technical report once its internal probe is complete. Withdrawals on the platform were expected to resume by late October or early November 2026. The remaining 60% of the stolen funds—amounting to over $3 billion—remains unaccounted for as analysts monitor the blockchain to see how the attackers attempt to launder or move the proceeds off-platform.