North Korea Behind the Binance Hack? Everything We Know About the $6.3 Billion Theft

Update 3 November, 01:03 UTC: Binance's proof of reserves can now be checked by users. In its “Recovery Update #5” of 2 November (12:45 UTC) Binance says the zero-knowledge proof for the 31 October snapshot is complete. Anyone holding BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD or ZEC on Binance can use the verification tool on the proof of reserves page to check that their balance is backed at least 1:1. The exchange says it has replaced about 95 percent of the stolen amount; the remaining 5 percent are less liquid tokens outside these ten. A new snapshot covering more tokens follows on 4 November, and its proof is expected to take 40 to 50 hours. The next phase of withdrawals for further networks is planned for 3 November. More: How to check Binance's proof of reserves.

Update 1 November, 07:48 UTC: Binance has reopened the first withdrawals. According to Binance's network status, Bitcoin withdrawals on the Bitcoin network have been available again since 07:00 UTC at the latest, and Ether on the Ethereum network, USDT and USDC on Ethereum and BNB Smart Chain, and BNB followed at around 07:48 UTC. Further phase-one networks are following step by step. Which 15 networks open first and what customers should watch out for is in Binance reopens withdrawals.

North Korea is behind the Binance hack of 29 October 2026, according to two leading blockchain investigators. TRM Labs attributes the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking group, and Chainalysis also sees the same group as the likely perpetrator. Binance itself has not named an attacker. It puts the damage at around $6.3 billion and, according to its announcement on X, expects to reopen withdrawals within 48 hours, by Sunday morning at the latest. Here is everything known so far about the largest crypto theft in history.

Binance hack: the key facts

• Attacker: TRM Labs names North Korea's TraderTraitor and Chainalysis sees the same group; Binance and authorities have not confirmed it.
• Damage: about $6.3 billion according to Binance, $6.36 billion according to TRM Labs, spread across ten blockchains.
• Start: 29 October, 20:05 UTC; most of the funds left within about 20 minutes, a second wave followed around 23:05 UTC.
• Frozen: about $2.7 billion according to TRM Labs, about $3 billion according to Binance, mostly by Tether and Circle.
• Still with the attacker: more than 420,000 ETH and 18,270 BTC, together about $2.4 billion.
• Customers: Binance will cover all losses; deposits work, withdrawals are due to resume by Sunday, 1 November, around 04:36 UTC.

How the evening played out in the market is in our timeline with live ticker, the first report in our Binance hack story.

Who is behind the Binance hack? The North Korea trail

TRM Labs bases the attribution on its own on-chain data and intelligence from outside the blockchain. The pattern matches two earlier attacks: the $1.5 billion hack of the exchange Bybit in February 2025, which the FBI attributed to TraderTraitor, and the attack on KelpDAO in April 2026. In all three cases the attacker's wallet was funded in advance through the mixer Tornado Cash, and the required signatures had been collected before any money moved.

Chainalysis CEO Jonathan Levin also considers TraderTraitor the likely perpetrator. According to SecurityWeek, his investigators found proceeds from last month's Bitget exploit mixed with the Binance loot. Binance says it is working with law enforcement but has not named an attacker, and no authority has made an official attribution yet.

TraderTraitor is a subgroup of the North Korean hacking network widely known as Lazarus. It targets employees of crypto companies, often through rigged job offers or trading apps, to gain access to internal systems. That fits what Binance says about how the attacker got in.

How did the Binance hack happen?

According to Binance's official announcement, a DevOps engineer's laptop was compromised. Through it, the attacker reached a service container and submitted unauthorized withdrawals. Binance found no evidence of a private key leak. TRM Labs goes further: because wallets on ten blockchains were emptied in the same window with ordinary, validly signed transfers, the attacker apparently made the hot wallet signing system itself work for him. A single stolen key or a phishing page does not explain that.

On Ethereum he used the EIP-7702 feature. In our own on-chain analysis we checked the decisive transaction: 50 pre-signed authorizations for the hot wallet “Binance 14”, one for each possible transaction number, so that one would hit. That preparation suggests his access to the signing system was limited in time.

Where is the money from the Binance hack?

About $2.7 billion is frozen according to TRM Labs; Binance itself speaks of about $3 billion. Most of it was blocked by the stablecoin issuers: Tether froze about 1.77 billion USDT, Circle about 825 million USDC. How we counted the freezes ourselves is in USDT frozen. Ripple added 40.5 million RLUSD, World Liberty Financial 27.8 million USD1, and the Arbitrum Security Council pulled about $30 million in ETH and ARB out of the attacker's wallet at 00:08 UTC.

Beyond the issuers' reach are more than 420,000 ETH and 18,270 BTC, together about $2.4 billion. The attacker used the time before the freezes: he swapped about 325 million USDT into roughly 122,300 ETH through UniswapX and similar services at a discount of more than 10 percent, supplied 60 million USDT to Aave to borrow about 19,760 ETH, and moved 300 million USDT on Tron into the lending protocol JustLend. The bitcoin is being split into chunks of 1,000 and 100 BTC to blur the trail. Unlike after Bybit, the group is relying less on cross-chain bridges this time and more on large swaps and lending protocols. On Tron, according to Elliptic, the attacker also swapped 234 million USDT for 638 million TRX, pushing the TRX price up by just over 9 percent within two hours; how that played out and how much TRX the attacker still holds is in our analysis of the TRX price after the Binance hack.

When will Binance withdrawals resume?

Deposits are working normally, Binance says. Withdrawals remain paused while the exchange completes a security revamp of the withdrawal service and its related addresses. At 04:36 UTC Binance said it expects to resume them within 48 hours, which would be Sunday, 1 November, around 04:36 UTC at the latest. Binance has not said whether all coins will reopen at once or step by step. Which networks were paused before the full halt is in our story on Binance withdrawals.

Service Update. Deposits remain unaffected and continue to operate as normal. Withdrawals remain paused while our team completes a security revamp of the withdrawal service and its related addresses. We expect to resume within 48 hours, and will update with further details.

Binance (@binance) October 30, 2026

Will Binance cover the losses from the hack?

Yes, according to its own pledge. Binance will cover all losses from its SAFU emergency fund and company funds. Whether the exchange can absorb the damage is what we calculate in How much would it take to bankrupt Binance?. Binance plans to publish an updated proof of reserves once the security work is complete.

If you do not want to keep larger amounts on an exchange, you can hold them yourself, for example in a hardware wallet, or spread your funds across regulated crypto exchanges.

What the Binance hack means for Bitcoin, BNB and the market

On Friday at 10:30 UTC Bitcoin traded at $77,296 according to CoinMarketCap, 3.4 percent lower than 24 hours earlier. BNB lost 5.4 percent to $700.66, Ether 3.9 percent to $2,226 and Solana 3.5 percent to $96.51. Measured against the size of the theft, that is a restrained decline, put into context in Bitcoin price after the Binance hack. The North Korea trail has a sober consequence for the market: state hackers do not hold on to their loot, they convert it in tranches over weeks. The more than 420,000 ETH held by the attacker are therefore what traders are watching most closely.

Our view: for Binance customers the question of who did it changes little. Two dates matter: whether withdrawals really resume by Sunday, and whether the announced proof of reserves shows full coverage. If both happen, pressure on BNB and the market should ease. If either slips, a security incident turns into a question of trust.

All our articles on the Binance hack

• What happened: The Binance hack, On-chain analysis, Timeline of the crash, USDT frozen
• Your money: Binance withdrawals, Could Binance go bankrupt?, Binance review
• Market: Bitcoin price after the hack, How low can Bitcoin fall?, BNB crash, Ethereum crash, Solana crash, How to short Bitcoin
• Background: The biggest crypto hacks in history