Binance hack of $6.3 billion linked to North Korean TraderTraitor group

Blockchain analysts say the rapid theft was carried out by the North Korean TraderTraitor hacking unit, prompting Binance to freeze $3 billion and use its SAFU fund to reimburse users.

By Felo News Desk · Published Fri, 30 Oct 2026 23:58:06 GMT

Binance confirmed that an estimated $6.3 billion in digital assets was stolen in a coordinated attack that moved funds across ten blockchains in roughly 20 minutes, according to multiple investigative reports.

What happened

The breach began shortly after 20:00 GMT on Thursday, when hackers accessed Binance’s hot‑wallet infrastructure and transferred cryptocurrency to external addresses on ten different blockchains. TRM Labs reported that most of the stolen assets left Binance‑controlled wallets within about 20 minutes. Binance subsequently froze roughly $3 billion of the affected assets and announced that its Secure Asset Fund for Users (SAFU) and other reserves would cover all user losses.

What the reports add

TRM Labs attributed the attack to TraderTraitor, a North Korean hacking unit previously linked to the $1.5 billion Bybit theft, and said it had "high confidence" in the attribution. Chainalysis and Elliptic also linked the theft to North Korea, though Binance has not officially confirmed the attribution (Mashable). Gizmodo added that an Ethereum network upgrade may have provided the attacker a single‑transaction method to empty one of Binance’s largest hot wallets, a detail not mentioned by Mashable. Both outlets note that Binance initially blamed a compromised DevOps engineer’s laptop but later acknowledged additional breach points.

What was said

Binance co‑founder Yi He told Mashable that the exchange will cover all losses using its reserve funds. Founder Changpeng Zhao, cited by Gizmodo, reiterated that users’ funds will be fully covered. TRM Labs’ analysts, quoted in both sources, described the theft’s speed and cross‑chain movement as characteristic of previous North Korean‑linked operations.

How it came about

Earlier this week Binance reported a security breach affecting $6.3 billion and announced a freeze of $3 billion in assets (Felo coverage). The exchange previously said an engineer’s laptop was compromised and that partners Tether and Circle helped freeze assets (Felo coverage). The current investigation builds on those disclosures, adding the attribution to the TraderTraitor group and the role of an Ethereum upgrade in facilitating the rapid outflow.

Key facts

Estimated $6.3 billion was stolen from Binance in a 20‑minute cross‑chain attack. (mashable.com)
TRM Labs attributes the hack to North Korea’s TraderTraitor hacking unit. (mashable.com)
Binance froze about $3 billion of the stolen assets and will cover all user losses. (gizmodo.com)

Where accounts differ

Exact mechanism enabling the rapid outflow: TRM Labs noted the speed but did not specify a technical trigger. (mashable.com); Gizmodo reported that an Ethereum upgrade gave the attacker a way to empty a hot wallet in a single transaction. (gizmodo.com)

Timeline

2026-10-30 — Binance reports $6.3 billion breach and freezes $3 billion
2026-10-30 — Binance freezes withdrawals after hack drains billions
2026-10-30 — Binance reports $6.3 billion hack blamed on North Korean hackers

Why it matters

The theft represents the largest crypto heist on record and highlights vulnerabilities in hot‑wallet security and the potential for state‑sponsored cybercrime to exploit blockchain upgrades.