On October 29, 2026, cryptocurrency exchange Binance suffered what is now being described as the largest cryptocurrency theft on record, after an attacker moved approximately $6.36 billion in digital assets out of wallets belonging to the exchange. The transfers took place across ten blockchain networks, with the bulk of the money disappearing in a burst lasting roughly 20 minutes.

According to blockchain intelligence firm TRM Labs, the operation began at around 20:05 UTC, with funds moving out of Binance wallets holding cryptocurrencies including Bitcoin, Ethereum, XRP, Solana and Tron-based assets. The transfers were directed towards addresses controlled by the attacker, with the stolen holdings valued at the prices prevailing when they were taken. Ethereum accounted for approximately $3.79 billion of the total, followed by Bitcoin at around $1.47 billion.

The scale of the operation was extraordinary even by the standards of an industry that has witnessed several billion-dollar cryptocurrency thefts. The amount was more than four times the approximately $1.5 billion stolen from cryptocurrency exchange Bybit in February 2025, another attack subsequently attributed to North Korean hackers.

The breach also forced Binance, the world’s largest cryptocurrency exchange, into an emergency response. The company temporarily suspended withdrawals across affected networks, began working with blockchain intelligence firms and law enforcement agencies, and sought assistance from other cryptocurrency companies to prevent the stolen assets from being moved further.

What initially appeared to be a major security incident was quickly turning into an industry-wide effort to contain one of the largest financial thefts in the history of digital assets.

How The Attack Unfolded And What Binance Discovered

The initial explanation offered by Binance pointed towards a possible compromise of a DevOps engineer’s laptop. In its October 30 security update, the exchange said the compromised device may have allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions. Binance, however, was careful to clarify that its investigation had found no evidence of a wallet private key leak.

The explanation became more complicated as the investigation progressed. Binance co-CEO Richard Teng subsequently said the incident was not simply a case of an attacker obtaining one employee’s permissions or executing a single unauthorised action. The exchange had uncovered additional points of breach and was still investigating how the attackers had gained access to its systems.

Teng also described the operation as involving a mechanism designed to destroy tools and traces of the intrusion, making it harder to reconstruct what had happened.

Blockchain intelligence firm TRM Labs offered another important piece of the puzzle. Its analysis suggested that the attackers had compromised Binance’s hot-wallet signing infrastructure, the systems responsible for authorising transactions from internet-connected cryptocurrency wallets.

On Ethereum, the attacker used an EIP-7702 delegation mechanism to give code under its control the ability to execute transactions from a Binance hot wallet. TRM identified 50 pre-signed authorisations prepared in advance. Transfers from wallets on the other affected blockchains followed through separately signed transactions.

An attacker does not necessarily need to steal a wallet’s private key if they can compromise the systems that authorise transactions using it. In this case, the movement of funds across multiple blockchains suggested that the problem extended beyond a single wallet or isolated transaction.

Binance subsequently suspended withdrawals, revoked the affected address authorisations and began reviewing its security infrastructure, including its endpoint systems, cloud environment, key management and transaction signing processes. The exchange said it would publish a detailed technical post-mortem once the investigation was complete and the facts had been verified.

The Race To Freeze $3 Billion In Stolen Cryptocurrency

The theft of $6.3 billion was only the beginning of Binance’s problems. Once the attackers had moved the assets out of the exchange’s wallets, the next challenge was preventing them from converting the cryptocurrency into other assets, transferring it across platforms or eventually cashing it out. What followed was an unusually coordinated response involving some of the biggest players in the digital asset industry.

Binance began working with blockchain intelligence firms, cryptocurrency exchanges and stablecoin issuers to trace the stolen funds. Tether, the issuer of USDT, froze approximately $1.57 billion in assets connected to the incident, while Circle, which issues USDC, blocked more than $800 million. World Liberty Financial and Ripple were also among the organisations involved in freezing or restricting assets linked to the theft. Collectively, industry participants identified and immobilised approximately $3 billion worth of the affected cryptocurrency.

The response shows an unusual feature of the cryptocurrency market. While blockchain transactions are generally designed to be irreversible, certain stablecoins have administrative controls that allow their issuers to freeze tokens held at specific wallet addresses. Tether and Circle can therefore prevent the movement of USDT and USDC even after those tokens have been transferred to wallets controlled by hackers.

That ability, however, does not extend equally across all cryptocurrencies. Bitcoin and other decentralised assets cannot simply be frozen by a central issuing company. This created a race between the attackers attempting to move the stolen holdings and the companies trying to restrict the assets still within their reach.

There was also an important distinction between freezing the funds and recovering them. Immobilising cryptocurrency prevents it from being transferred or liquidated through the affected addresses, but it does not automatically establish ownership or ensure that the assets can immediately be returned to Binance.

The FBI Points To North Korea And Its TraderTraitor Hacking Unit

On October 31, the Federal Bureau of Investigation (FBI) formally attributed the Binance theft to North Korea, identifying the operation as TraderTraitor. The announcement was significant because it moved the investigation beyond the suspicions raised by blockchain intelligence firms in the immediate aftermath of the breach.

The FBI said North Korean cyber actors had stolen more than $6 billion in virtual assets from Binance on or around October 29. It also disclosed that investigators, working alongside the US Secret Service and Internal Revenue Service Criminal Investigation division, had observed the attackers converting the stolen assets primarily into Ethereum.

According to the agency, the funds were expected to be moved through decentralised finance (DeFi) platforms and instant cryptocurrency swap services as part of further laundering efforts. The FBI consequently urged blockchain infrastructure operators, cryptocurrency exchanges, DeFi services and other virtual asset providers to block transactions involving wallet addresses associated with the operation. It also published a list of addresses identified as being controlled by or closely connected to the North Korean actors.

TraderTraitor is associated with North Korea’s broader state-linked cyber operations and has previously been linked to attacks targeting cryptocurrency businesses. The FBI had also attributed the February 2025 Bybit theft, involving approximately $1.5 billion, to the same North Korean hacking operation.

The Binance attribution therefore placed the latest breach within a much longer pattern of cryptocurrency thefts linked to North Korean cyber actors. For the global crypto industry, the concern was no longer limited to one compromised exchange. It was the growing ability of these operations to target major digital asset platforms, move enormous sums across blockchain networks and exploit the difficulty of recovering decentralised assets once they enter the laundering process.

North Korea’s Billion-Dollar Cryptocurrency Theft Operations

The Binance breach is part of a much larger pattern of cryptocurrency thefts attributed to North Korean state-linked hacking groups. Over the past several years, these operations have increasingly targeted cryptocurrency exchanges, blockchain networks and digital asset platforms, allowing hackers to steal funds that can potentially be converted into foreign currency outside conventional banking channels.

North Korea’s interest in cryptocurrency has to be viewed against the backdrop of international sanctions and restrictions on its access to the global financial system. Cryptocurrency offers a way to move funds across borders without relying on the traditional banking infrastructure, although converting stolen digital assets into usable money requires a separate and often complicated laundering operation.

One of the most significant earlier incidents was the February 2025 attack on Bybit, in which approximately $1.5 billion in cryptocurrency was stolen. The FBI attributed that operation to North Korean hackers associated with TraderTraitor. The attack demonstrated how a major cryptocurrency platform could be compromised even when its underlying blockchain networks continued to function normally.

The Binance theft is considerably larger and reinforces concerns about the growing scale of these operations. Chainalysis estimated that suspected North Korean-linked hacking groups accounted for nearly 89% of reported cryptocurrency hacking losses through October 29, 2026, compared with approximately 15% in 2021. The figures illustrate how concentrated cryptocurrency theft has become around a relatively small number of sophisticated, state-linked operations.

Binance’s Financial Response And The Question Of Customer Confidence

For Binance, the immediate challenge following the breach was not just containing the stolen funds but convincing millions of customers that their assets remained safe. With more than $6 billion affected, the exchange faced the possibility that a security incident could quickly turn into a much larger crisis of customer confidence.

Binance responded by committing to cover the financial impact through its own resources rather than passing the losses on to customers. The exchange said it would use a combination of its corporate treasury, its Secure Asset Fund for Users (SAFU) and its Futures Insurance Fund to replenish the affected assets.

The SAFU fund is particularly important in this context. Established in 2018, it serves as Binance’s emergency reserve to protect users in exceptional circumstances, including security incidents. Binance had previously announced that it was converting the fund’s holdings into Bitcoin, with a target value of $1 billion.

By October 31, co-CEO Richard Teng announced that the exchange had replenished approximately 90% of the stolen assets, amounting to roughly $6 billion. The remaining 10% consisted largely of less liquid tokens that could take longer to source in the required quantities. Teng reiterated that customers would not bear the financial impact of the incident.

The exchange also indicated that it remained on track to resume withdrawals on November 1, subject to security checks. Meanwhile, the breach had already affected sentiment across cryptocurrency markets, with Bitcoin, Ethereum and BNB experiencing declines following news of the attack.

For Binance, replacing the stolen cryptocurrency was an important first step. But financial compensation and operational security are two different questions. The exchange may be able to restore the affected balances using its own resources, but it still has to demonstrate that the weaknesses exposed by the breach have been addressed.

Cathie Wood’s Warning And The Growing Role Of AI In Cybercrime

While the Binance breach exposed the vulnerabilities of cryptocurrency infrastructure, it also brought renewed attention to another emerging cybersecurity challenge: the growing capabilities of artificial intelligence. As companies increasingly deploy AI to automate operations, analyse data and improve productivity, cybersecurity experts are also concerned that the same technology could give malicious actors more effective tools to identify weaknesses and carry out attacks.

Frank Downing, director of research for AI and cloud at Cathie Wood’s ARK Invest, raised this concern during an appearance on CNBC as the Binance incident unfolded. Downing said the firm had been monitoring the risks associated with increasingly capable AI models, arguing that the technology was making hackers more productive alongside legitimate businesses.

His warning was not that AI had been responsible for the Binance theft. No evidence had emerged linking artificial intelligence to the execution of this particular attack. Rather, his concern was about how quickly the cybersecurity environment could change as increasingly powerful models became accessible to both attackers and defenders.

Downing also argued that restricting access to advanced AI models might not necessarily solve the problem, given that hackers could already use powerful open-source alternatives. Instead, cybersecurity teams would need access to equally capable tools to identify vulnerabilities, monitor suspicious activity and respond to attacks before they cause significant damage.

The concern adds another dimension to an industry already struggling with increasingly sophisticated cyber operations. For cryptocurrency exchanges, where a successful breach can translate into billions of dollars moving across blockchain networks within minutes, the ability to detect and respond to attacks quickly is becoming as important as preventing unauthorised access in the first place.

What The Binance Heist Reveals About The Security Of The Crypto Industry

The Binance theft raises a difficult question for an industry that has spent years promoting cryptocurrency as a more transparent and secure alternative to conventional financial systems: how secure are the platforms responsible for holding and moving these assets?

The underlying blockchain networks were not necessarily compromised in the incident. Instead, the attack appears to have exploited weaknesses in the infrastructure used by Binance to authorise transactions. This distinction is important because blockchain security and exchange security are not the same thing. A blockchain can continue operating as designed while the systems responsible for managing users’ assets remain vulnerable.

The incident also exposed an unusual contradiction in the cryptocurrency market. Although decentralisation is one of the industry’s central selling points, the recovery effort depended heavily on centralised companies such as Tether and Circle being able to freeze assets. Their intervention helped prevent billions of dollars from moving further, but it also demonstrated how much control stablecoin issuers retain over the tokens they create.

For exchanges, the implications extend beyond strengthening wallet security. The breach has raised questions about employee device protection, access management, transaction authorisation systems, cloud infrastructure and the ability to detect suspicious withdrawals before enormous amounts of money disappear.

There is also the question of customer confidence. Binance’s decision to replace approximately 90% of the stolen assets within days demonstrated its financial capacity to absorb an extraordinary loss. However, not every cryptocurrency exchange has the reserves or financial resources to respond in the same way.

The incident therefore goes beyond the security failure of one exchange. With North Korean-linked hacking operations continuing to target digital asset platforms and AI potentially making cyberattacks more productive, the ability of cryptocurrency businesses to protect customer funds is becoming a defining test for the industry.