North Korean group blamed for $6.3bn Binance hack in biggest ever crypto heist

 

North Korean group blamed for $6.3bn Binance hack in biggest ever crypto heist

 

Cryptocurrency exchange scrambles to freeze affected assets, with about $3bn located so far

 

Dan Milmo and agencies

Fri 30 Oct 2026 09.19 CET

https://www.theguardian.com/business/2026/oct/29/binance-crypto-exchange-hack

 

The world’s largest cryptocurrency exchange has been hit by an industry-record $6.3bn (£4.7bn) hack, with experts identifying North Korea as the likely culprit.

 

Binance has scrambled to freeze the affected assets, with about $3bn located so far. The company gave no update on the other $3.3bn as Binance’s co-founder Yi He said the company would cover “all hacking losses”.

 

Analysts attributed the attack to North Korean state-backed hackers. North Korea has a history of crypto hacking and was behind the theft of approximately $1.5bn in virtual assets from a Tokyo cryptocurrency exchange last year, according to the FBI, in what was the previous record crypto heist.

 

TRM, a crypto analysis firm, blamed the attack with “high confidence” on TraderTraitor, North Korea’s elite hacking unit. Chainalysis, another analysis outfit, also attributed the heist to TraderTraitor.

 

Binance did not explicitly confirm that funds had been stolen, although TRM and Chainalysis claimed more than $6bn had been taken. The company said its teams were “working around the clock” to resolve the problem.

 

An initial investigation suggested the breach may have started with a hacked laptop belonging to one of Binance’s engineers, which let an attacker gain access to one of its systems and ⁠make unauthorised withdrawals, Binance said.

 

Binance, which allows users to buy, sell and trade digital assets, has 335 million registered users globally and had about $162.8bn in assets under custody as of the exchange’s 2025 annual report.

 

Richard Teng, a co-chief executive of Binance, said: “Bottom line – your money is safe, and we’re covering every loss.”

 

The company said in a statement: “As a precaution, all deposits and withdrawals are temporarily suspended while our security teams conduct checks, secure wallet infrastructure and trace affected assets, with the close support of our law enforcement and industry partners.”

 

Markets reacted immediately in early Asian trading on Friday, and bitcoin – the most popular crypto asset by far – dropped more than 3% to a six-week low of $76,368. Shares in the crypto exchange Coinbase Global slid 4.8%, while those of the bitcoin buyer Strategy fell nearly 6% in extended US trading.

 

Binance was founded in 2017 by Changpeng Zhao, who in 2023 pleaded guilty to a felony in the US related to his failure to prevent money laundering on the platform and stepped down as CEO. Donald Trump pardoned him in 2025.

 

Zhao posted to X on Thursday: “User funds are safe!” but added that the incident “does look like a hack on Binance”. He added that while he did not manage Binance any more, “as a shareholder, I expect all user funds will be fully covered”.

 

If confirmed, the incident could be the world’s biggest crypto ​heist, according to Chainalysis and other industry experts. “It’s the biggest hack in history,” said Aravind ‌Srinivasan, the head of the large crypto market maker GSR’s systematic ‌OTC business.

 

Beyond the potential loss of assets, the security breach was likely to have wider ramifications for crypto, which had already been under pressure lately because of higher US interest rates and softer demand from ‌exchange-traded fund buyers, analysts said.

 

“It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges, as well as counterparty, solvency and liquidity risks,” said Tim Sun, a senior researcher at HashKey Group, based in Hong Kong.

 

Binance runs a secure asset fund for users, which is a reserve held entirely in ‌bitcoin that is intended to protect user assets in cases of security breaches, according to its website.

 

Bernardo Brites, the CEO of Trace Finance, a payments and stablecoin infrastructure company, said: “It’s becoming very hard to counter hacks as AI can find vulnerabilities faster than you can fix them. My view is that users will move away from smaller ​and medium-sized exchanges, [as it is] becoming too risky to park your money somewhere that couldn’t cover a hack of meaningful size.”

 

The stablecoin issuer Tether said it had frozen nearly $1.57bn in assets linked to the incident, while Circle froze more than $800m.

 

World Liberty Financial, a crypto company linked to Trump and his family, said on Thursday it had worked with the cryptocurrency custodian BitGo to freeze funds stolen in what it described as a Binance hack.

 

Binance’s Yi said $27m in stablecoins and about $2m worth of World Liberty tokens had been frozen.

 

The incident adds to a string of crypto thefts. Last year attackers stole $2.9bn worth of cryptocurrency across nearly 150 attacks, according to researchers ​at TRM Labs. In September the cryptocurrency exchange Bitget ‌said roughly $350m in crypto had ​been stolen from its platform, underscoring the industry’s vulnerability ​to hackers.

 

Authorities have warned that organised crime groups are increasingly using cryptocurrencies to move funds across borders outside the traditional financial system.

 

Binance.US, a separate cryptocurrency exchange, said it was not affected by the security incident.

 

Coinbase said it was unaffected and was monitoring the situation.

 

In an unrelated incident earlier on Thursday, the prediction market operator Polymarket temporarily halted trading after a security incident involving a third-party provider. It later resumed trading and said it would fully reimburse affected traders.

 

With Reuters and the Associated Press