The Biggest Crypto Heist in History

The cryptocurrency world witnessed in late October the largest theft ever recorded in its history: approximately $6.3 billion were stolen from Binance, the world's largest cryptocurrency exchange by trading volume. The attack, discovered on October 29, revealed not only the unprecedented scale of the crime but also the sophistication of a hacker group linked to the North Korean government that uses cybercrime as a revenue stream for the regime.

The attack

Around 4:20 PM Eastern Time on October 29, funds began leaving Binance's hot wallets across multiple blockchains. According to Chainalysis's analysis, the attacker used an operational wallet funded through Tornado Cash — a blockchain privacy tool — to submit valid signed authorizations that allowed Binance's compromised wallet to execute malicious code deployed by the attacker. The funds were then transferred to attacker-controlled addresses, totaling $6.4 billion across the affected blockchains.

Binance co-CEO Richard Teng described the incident as a "complex attack" involving a compromised laptop and malicious software specifically designed to delete evidence of its activity, making it extremely difficult to trace and investigate. The nature of the attack suggests the intruders had already obtained access to the company's environment for weeks or months before the massive withdrawal.

Industry and government response

Within hours, the cryptocurrency industry mobilized a coordinated response. Stablecoin issuers — Tether (USDT) and Circle (USDC) — initiated freezes on billions of dollars in stolen funds, while U.S. law enforcement agencies including the FBI, Secret Service, and IRS Criminal Investigation worked in conjunction with blockchain analytics firms like Chainalysis. Approximately $2.8 billion was frozen across multiple blockchains, setting a record for real-time coordination in the sector.

The connection to North Korea was confirmed when Chainalysis investigators observed that funds stolen from Binance were commingled with funds stolen from a Bitget exploit the previous month, already attributed to North Korean actors. That direct on-chain link confirmed that the TraderTraitor group — part of the more famous Lazarus Group — was behind the attack.

The FBI issued an official alert in the early hours of October 31, stating that the Democratic People's Republic of Korea was "responsible for the theft of more than $6 billion" and that it had observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). The agency warned that the funds were expected to be further laundered through DeFi platforms and instant-swap services.

Binance's coverage

In a move that is unusual for the sector, Binance announced it would fully cover user losses, using corporate funds and the SAFU (Secure Asset Fund for Users). So far, the exchange has reimbursed 90% of stolen assets, including 100% coverage for BTC, ETH, USDT, BNB, SOL, USDC, XRP, and other major stablecoins. The remaining 10% consists of tokens outside the top 10, with lower market liquidity, which will likely require more time to replenish.

User withdrawals were suspended after the attack but gradually resumed starting November 1 in phases. Bitcoin, Ethereum, and USDT were the first to have services restored, followed by other networks including the Ethereum Network and BNB Smart Chain.

What this means

This attack raises fundamental questions about the security of centralized exchanges in 2026 — a sector that should have matured significantly with the industry's scale. North Korea, under extensive international sanctions for its nuclear and missile programs, continues to use cybercrime as a revenue-generating mechanism, with estimates from intelligence agencies indicating Pyongyang earns billions of dollars annually from hacking operations.

The industry's coordinated response — with $2.8 billion frozen within hours — demonstrates important maturation. But the question remains: in a market where $6.3 billion can disappear in minutes, is the current security structure sufficient for any exchange, or are we witnessing only the first act of an escalation that we still don't fully understand?

Sources: Al Jazeera, CNBC, Chainalysis

✓ Independent sources cross-checked and verified before publishing