Key Takeaways
- The FBI said on October 31, 2026, that North Korea was responsible for the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance on or about October 29, 2026, and refers to the activity as TraderTraitor.
- Binance estimated the impact of the October 29, 2026 theft at about $6.3 billion, while blockchain analytics firms TRM Labs, Chainalysis, and Elliptic counted $6.36 billion to $6.43 billion, the largest crypto theft on record.
- Binance said its initial investigation pointed to a compromised DevOps engineer's laptop that let an attacker submit unauthorized withdrawal transactions, and later said it had found additional points of breach.
- Stablecoin issuers including Tether and Circle froze part of the stolen Binance funds, roughly $3 billion by Binance's estimate, and on October 31, 2026 Binance said it had replaced 90% of the stolen assets with company money.
What happened
Funds began leaving wallets belonging to Binance, the world's largest cryptocurrency exchange, at about 20:05 UTC on October 29, 2026, according to blockchain analytics firms TRM Labs and Elliptic. TRM Labs said most of the money left in about 20 minutes, from Binance wallets on ten blockchains. Elliptic counted 11 blockchains drained over a few hours, with a second wave shortly after 23:00 UTC.
The affected wallets were hot wallets, which TRM Labs describes as wallets connected to the internet that an exchange uses to process customer withdrawals. TRM Labs said preparation for the attack began at least 36 hours before the theft.
Binance first said it was investigating a potential security issue, the Associated Press and TRM Labs reported. It then put the estimated impact at about $6.3 billion and suspended deposits and withdrawals while it ran security checks, according to the AP and The Hacker News.
How the attacker got in
Binance said its initial investigation suggested the incident "may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." It said it had found no evidence of any wallet private key leak.
In a later statement, Binance said its investigation had uncovered additional points of breach, without saying where, ABC News and Elliptic reported. Binance co-CEO Richard Teng said on October 30 that the attack involved malicious software designed to delete evidence of its activity, according to Elliptic and Reuters. Elliptic reported that Teng also said the attack "was not carried out by one person."
TRM Labs said the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains. Elliptic said the attacker appears to have been able to get Binance's own systems to sign transactions on their behalf rather than stealing Binance's private keys. Binance has said it will publish a detailed technical post-mortem once its investigation is complete.
How much was taken and frozen
Binance put the impact at about $6.3 billion. TRM Labs counted about $6.36 billion, Chainalysis about $6.4 billion, and Elliptic $6.43 billion. The largest losses were on Ethereum, about $3.8 billion, followed by 18,270 bitcoin, according to TRM Labs and Elliptic.
TRM Labs said the theft is about four times the size of the $1.5 billion Bybit hack of February 2025. Elliptic said it is almost certainly the largest single theft of any kind in history.
Stablecoins, tokens whose issuers can freeze wallets that hold them, made up $3.46 billion of the stolen funds, according to Elliptic. Tether said it froze more than $1.5 billion and Circle more than $800 million, the AP reported. Ripple, World Liberty Financial, and the Arbitrum network's Security Council also froze funds, TRM Labs and The Record reported.
Binance put the amount frozen at roughly $3 billion. Elliptic said it had verified $2.85 billion of frozen or seized funds, and Chainalysis put the frozen total at about $2.8 billion.
As of early October 31, the attacker controlled about $3.21 billion of assets that cannot be frozen by an issuer, including 18,270 bitcoin, Elliptic said. Chainalysis and Elliptic both said the laundering shows signs of automation.
Who is behind it
The FBI said in an alert on October 31 that North Korea was responsible for the theft and that it refers to this activity as TraderTraitor. The FBI said it, the U.S. Secret Service, and the IRS have seen TraderTraitor actors convert the stolen assets mainly into Ether. The FBI expects further laundering through decentralized finance (DeFi) and instant swap services.
Blockchain analytics firms named the same group before the FBI did. TRM Labs attributed the attack to TraderTraitor with high confidence on October 29, based on what it called "robust on and off-chain intelligence." Chainalysis said it saw funds stolen from Binance mixing on-chain with funds from the September 2026 theft from the exchange Bitget, which was attributed to North Korea. Elliptic, writing before the FBI statement, said it was likely that TraderTraitor carried out the theft but that the attribution was not yet certain.
The FBI previously named TraderTraitor as responsible for the $1.5 billion Bybit hack in February 2025, TRM Labs noted. Elliptic said actors linked to North Korea are believed to have stolen more than $6.5 billion in crypto in recent years, and that the U.S. government has linked these thefts to the funding of North Korea's weapons programs.
Binance's response
Binance said it will cover all losses from its Secure Asset Fund for Users (SAFU) and its own funds, according to The Hacker News and ABC News. On October 31, Binance said it had replaced 90% of the stolen assets, ABC News and Reuters reported. The remaining 10% consists of tokens that are less liquid, Reuters reported.
Binance said it was still on track to reopen withdrawals on Sunday, November 1, according to Reuters. The company said it will publish an updated proof of reserves, its report showing that customer assets are backed, once remediation is complete. Binance.US, a separate exchange, said it was not affected, ABC News reported.
What organizations should do
The FBI, the Secret Service, and the IRS urge THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from the addresses TraderTraitor is using to launder the stolen assets. The FBI published the addresses in its alert and asks anyone with information to contact a local FBI field office or its Internet Crime Complaint Center (IC3).
TRM Labs advises exchanges and compliance teams to screen deposits and counterparties against the attacker addresses it has labeled. It also recommends that firms separate signing infrastructure and approval paths by chain and wallet tier. Elliptic has published a free blocklist of more than 1,000 addresses linked to the theft.