$6.3 Billion, 20 Minutes, One Hack
October 30, 2026, Evening
The largest cryptocurrency theft in history happened on October 29, 2026. Hackers drained $6.3 billion from Binance wallets across at least ten blockchains, including Ethereum, Bitcoin, Tron, and Solana. The majority of the funds were taken in roughly 20 minutes [1].
Three crypto-tracing firms, TRM Labs, Chainalysis, and Elliptic, have linked the attack to the North Korean hacking group TraderTraitor. The strongest evidence: Chainalysis investigators watched, in real time, stolen Binance funds commingling with funds from last month's Bitget exploit, which had already been attributed to North Korean actors [1].
How It Happened
Preparation began at least 36 hours before the theft. The attacker deployed test code on two Binance wallets on October 28, rehearsed the final version on a third wallet, then routed the test funds back. Four hours after the rehearsal, the same code was installed on a Binance hot wallet [1].
Hot wallets are internet-connected wallets that crypto exchanges use to process customer withdrawals. When the attack went live, funds were drained from hot wallets across multiple blockchains simultaneously and sent to addresses controlled by a single attacker [1].
Binance says the attack began with a compromised engineer's laptop. Targeting crypto company staff is a TraderTraitor hallmark. The attacker also funded their wallet through Tornado Cash and rehearsed the attack in advance, mirroring the $1.5 billion Bybit hack from last year, which the FBI attributed to the same group [1].
The Money
Of the $6.3 billion stolen, about $2.8 billion (44%) has been frozen by crypto companies and exchanges. Almost all of the frozen funds are stablecoins. The remaining $3.3 billion is mostly Bitcoin, Ether, and XRP, which no one can freeze. It can only be intercepted when it reaches an exchange or service [1].
Chainalysis reports seeing money laundering patterns they have never observed before, with thousands of transactions processed quickly through automation to obscure the trail [1].
TraderTraitor's Track Record
TraderTraitor is an elite subset of North Korea's sprawling hacking operations, which exist largely to earn money for the heavily sanctioned regime. The group specializes in infrequent but high-profile attacks on crypto and decentralized finance companies. Before Binance, their largest known heist was the $1.5 billion Bybit hack. If North Korea is behind the Binance theft, this single heist would almost double everything the regime has stolen in crypto to date [1].
"These folks in particular are somewhat artists in terms of getting into these distributed finance organizations," said Rafe Pilling, a senior director of threat intelligence at Sophos [1].
Binance's Response
Binance suspended all deposits and withdrawals immediately after detecting the breach. The company says it will cover all losses from the hack and is working with law enforcement. In a statement, Binance described the attack as complex, initially suggesting a compromised laptop but later uncovering additional points of breach [1].
Neither Binance nor law enforcement have officially confirmed the North Korean link [1].